Protected credentials
Broker and API credentials are kept in managed secret stores, never in application code. Credentials are injected into services at runtime and are never written to logs.
Security
Security and control, by design
Helmvora handles investment decisions, so security and human control are built into the foundation.
Encrypted in transit and at rest
TLS on every endpoint and encrypted storage volumes. Certificates are issued and renewed automatically.
Mandatory human approval
No trade executes without an explicit approval decision. Approval requests are signed, verified, and expire if not acted on.
Layered risk checks
Risk validation runs before approval and again immediately before execution. A failed check stops the trade, regardless of approval.
Prohibited by design
Margin, short selling, and leverage are blocked at the platform level. These restrictions are enforced in code and cannot be switched on by an AI component.
Complete audit trail
Recommendations, approvals, and executions are recorded in an append-only audit log. Audit records are retained and never deleted automatically.
Access control
Internal tools sit behind single sign-on, and the public website is kept separate from trading systems.
What we don't claim
Helmvora has not yet completed an independent security audit or certification. We'll update this page as that changes.
Reporting a security issue
If you believe you've found a security vulnerability, please contact us through the contact page and describe the issue. Please don't publicly disclose it until we've had a chance to respond.
Be Among the First to Experience Helmvora
Join the waitlist and we'll email you when Helmvora launches.
Join the Waitlist