Where your data lives
- Your account data, workspace content and files are stored in the EU.
- Your project's code runs in isolated environments in the EU, separate from the servers that hold your account data.
- By default, each task's agent runs in its own short-lived environment, which is deleted when the task ends.
Encryption
- All traffic to hlix is encrypted in transit with HTTPS.
- Project secrets, access tokens for services you connect, and your own AI model keys are encrypted with AES-GCM before we store them.
- Passwords are stored only as hashes.
- Secrets are written into a project's environment as files, never passed on command lines, and kept out of commits to your repository.
Access control
- Sign in with a password, a one-time email code, Google, GitHub, or a passkey.
- Every request is scoped to one workspace. Inside a workspace, what a person can do follows the role you give them. Clients you invite see only the projects you share with them.
- Agents get a credential for one project only. It can reach only a short list of actions, expires with the task, and is revoked when the task ends.
- API keys can be revoked at any time under Developer Tools in the dashboard.
Audit trail
Actions in your workspace are written to an audit log. It is append-only: entries cannot be changed or deleted. Each entry is chained to the one before it with a hash, so tampering can be detected, and workspace owners and admins can verify the chain.
Your code, your decision
Every change an agent makes is checked by an AI review, and by your project's own tests when it has them. For a project connected to your repository, hlix opens a pull request and never merges it into your main branch for you.
Report a vulnerability
Email security@hlix.ai. For anything else, write to support@hlix.ai.
- Include the steps to reproduce the issue and what it affects.
- Give us a reasonable time to fix it before you share it with anyone.
- Do not access, change or delete other people's data, and do not disrupt the service while you test.
We will confirm we received your report within 3 business days. We will not take legal action against research done in good faith under these rules.