Security

In Plain Terms (As of October 2026)

• Model training: customer drawings and project data are not used to train or fine-tune AI models.
• Retention: we keep data for as long as needed to provide the service. We publish no fixed number of days.
• Deletion: we delete or anonymize your data on request, unless the law requires us to keep it. You can export your data in a portable format, and after an account ends, data may be deleted under our retention policy.
• Subprocessors and model providers: Helonic runs on cloud infrastructure, with managed cloud services for database and deployment, and may use vetted third-party AI and cloud providers to run models. Each provider is evaluated for security posture, privacy controls, and contractual data-use commitments.
• Certification and encryption: Helonic is SOC 2 compliant. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
• Ownership: you keep ownership of the drawings you upload. Helonic uses them only to provide the service.

The named list of subprocessors and model providers, a retention period in days, and our SOC 2 report are not published here. Send questions to founders@helonic.com

For the full list of questions to ask any AI drawing review vendor, with our answer to each, see 20 data security questions, with Helonic’s answers.

Our Commitment to Security

Security is foundational to how we build and operate Helonic. We understand that construction drawings and project data are sensitive, and we are committed to protecting the confidentiality, integrity, and availability of every customer’s data. This page describes the safeguards and practices we maintain across our platform and organization.

Compliance

Helonic is SOC 2 compliant. Our controls are independently assessed against the SOC 2 Trust Services Criteria for security, and we maintain our program on an ongoing basis.

Data Encryption

• All data is encrypted in transit using TLS 1.2 or higher
• All data is encrypted at rest using AES-256 encryption
• Secrets and API keys are managed through a dedicated secrets management system and are never stored in plaintext

Infrastructure Security

• Our infrastructure is hosted on established cloud providers that maintain their own physical and network security controls
• Infrastructure is provisioned and managed through version-controlled infrastructure-as-code to ensure consistency and auditability
• Network access is restricted through firewalls, security groups, and the principle of least privilege
• Automated, redundant backups protect against data loss

Access Control

• Access to production systems and customer data is restricted to authorized personnel on a need-to-know basis
• Multi-factor authentication is required for access to critical systems
• Access is reviewed regularly and revoked promptly when no longer required
• Strong authentication and session management protect user accounts

Monitoring and Logging

• Systems are continuously monitored for availability, performance, and suspicious activity
• Audit logs are maintained for access to sensitive systems and data
• Alerts notify our team of anomalous or unauthorized activity

Application Security

• Code changes are reviewed before being deployed to production
• Dependencies are monitored for known vulnerabilities
• We follow secure development practices throughout our software lifecycle

Incident Response

We maintain an incident response process to detect, respond to, and recover from security events. In the event of an incident affecting your data, we will investigate promptly and notify affected customers in accordance with applicable laws and our contractual commitments.

Reporting a Vulnerability

If you believe you have discovered a security vulnerability or have a security concern, we want to hear from you. Please contact us at:

founders@helonic.com