Sensitive operating work needs visible boundaries.

Policy notes

Detailed control posture

These notes describe the public trust posture. Customer-specific commitments, regions, support access, subprocessors and private deployment terms are confirmed in the relevant order form, customer agreement or data processing agreement.

Access control

SOVHELM is designed to support role-based permissions for founders, partners, managers, team members, investors, suppliers and delegated assistants. Venture-level separation is a core principle so users only see the businesses, entities, projects, obligations, files and records they are allowed to see.

Demo and live workspace separation

Public demo workspaces are separated from live customer workspaces. Demo accounts are intended for product exploration and guided review. Live customer workspaces use the customer’s organization boundary, membership, role assignments, venture scopes and data-store persistence rules.

Persistence and sync recovery

Live operating records are designed to persist through the Supabase-backed data store. The application surfaces sync state, retry behaviour, failed-save recovery and workspace refresh controls so important work is not treated as disposable browser state.

Auditability

Audit logs are intended to help teams understand important changes across ventures, compliance obligations, risks, decisions, comments, mentions, notifications, attachments, generated work and access-sensitive actions.

Customer data and AI

Customer workspace data belongs to the customer. SOVHELM does not use customer workspace data to train AI models. Assisted capabilities are designed to process workspace records for the customer’s own operating signals, subject to the agreed controls and deployment model.

Data protection

SOVHELM production infrastructure uses HTTPS, hardened deployment headers, controlled access to operational systems, service-side privileged actions where required, monitored operational logs, and appropriate backup and recovery practices. Customer data processing is documented as part of workspace onboarding and contractual setup.

Infrastructure providers

The current hosted model uses Vercel for application delivery and Supabase for Auth, Postgres, Row Level Security and private storage. Additional services such as email delivery or analytics may be introduced only for the purpose needed and should be reviewed where a customer has stricter requirements.

Encryption and transport

Public and hosted application traffic is served over HTTPS. Hosted workspace storage uses provider-managed database and storage protections. Customer-specific encryption, key management or private infrastructure requirements should be reviewed before sensitive import.

Hosting and data residency

Incorporation jurisdiction, hosting region, support access, subprocessors and data transfer terms are separate concerns. Customers with stricter sovereignty, client, investor or regulatory requirements can discuss regional hosting, private deployment or customer-controlled operating models before sensitive data is imported.

Support access

SOVHELM support access to customer workspaces is limited to operational support needs. Higher-control plans may include owner-approved support access, access logging and reduced vendor access modes where appropriate for the deployment.

Deletion, backup, and recovery

Workspace retention, backup, export, deletion and recovery expectations should be agreed during onboarding. The product is designed to preserve audit history and reference recovery where appropriate, while sensitive erasure requests need controlled handling so related records do not become misleading.

Assurance status

SOVHELM publishes implemented controls and support commitments rather than unsupported badges. Formal assurance packages, uptime commitments, audit materials or customer-specific security reviews are provided only when they are agreed, documented and available for the relevant customer plan.

Lawful requests

SOVHELM only discloses customer data where legally required. Where legally permitted, we aim to notify the customer before disclosure and challenge requests that are improper, excessive or not valid for the relevant jurisdiction.

Responsible disclosure

If you believe you have found a security issue, contact security@sovhelm.com with enough detail for review. Please do not access, modify, delete or disclose data that does not belong to you.