Security and data handling
What we do to protect the API and the data behind it, stated plainly, and the part that is yours to do.
Our controls
| Area | What we do |
|---|---|
| Transport | HTTPS only, terminated at Cloudflare. Plain HTTP is not served. |
| Single front door | The application only accepts /v1 traffic that came through our API gateway. Calling the application host directly is refused with 403. |
| Edge filtering | Requests without a well-formed Helix key are rejected at the edge before reaching the application. Per-key and per-IP flood limits and a 10 MB body cap apply there. |
| Key storage | Keys are stored only as SHA-256 hashes. Plaintext is shown once at issue and never stored. |
| Least privilege | Scopes limit both routes and personal-data fields. Keys can be restricted to source IP addresses. |
| Rate limiting | Exact per-key, per-minute limits shared across all servers, so a burst cannot exceed the plan. |
| Access log | Each release of contact, pay or document fields is recorded: which key, which candidate, which field groups, when. Test keys release only synthetic data and are not logged this way. |
| Usage records | Per-call usage (endpoint, credits, status, request id) is kept for 90 days to support billing disputes and your own usage reports. |
| Webhooks | HMAC-SHA256 signed with a per-endpoint secret and a timestamp. https only; private, loopback and link-local destinations are refused; redirects are not followed. |
| Resume downloads | Links are pre-signed and expire after 10 minutes. |
| Uploads | Resumes sent to the parse endpoints are processed and not stored. |
| Payments | Handled by Cashfree. Card and UPI details never reach Helix. Payment webhooks are signature-verified and each order is credited exactly once. |
| Billing integrity | Credits are debited atomically before work is done and refunded if the call fails on our side, so a crash cannot leave you charged for nothing or us unpaid. |
Your side
- Call from a server. Keep the key in a secret manager or environment variable, never in source control, a browser or a mobile app.
- Issue separate keys per environment and per system, with only the scopes each needs. An agent that only needs summaries should not hold
pii:contact. - Ask for an IP allowlist if your servers have fixed egress addresses.
- Verify webhook signatures and reject timestamps older than 5 minutes. See Webhooks.
- Copy a resume you need to keep out of the 10-minute link into your own store, under your own retention policy.
- Rotate keys on staff changes and after any suspected exposure; tell us and we revoke immediately.
About the data
Candidate records are what candidates and their resumes told us. Compensation figures are self-reported and unverified, so treat them as indicative. Market statistics never reveal a group smaller than 5 people. You are responsible for using personal data you obtain through the API lawfully and for the purpose of hiring, under your agreement with Helix and the data-protection law that applies to you.
Reporting a vulnerability or incident
Email support@helixhumancapital.in with the request id, time and a description. We acknowledge reports, and a leaked key is revoked on request straight away. Please do not test against other customers' data or run load tests against production without agreeing it with us first.