Helios Field and Helios Ledger
Helios Field and Helios Ledger are served over HTTPS. Cloudflare terminates the public connection and hosts the application.
Each workspace is isolated. A request is scoped to the signed-in tenant. The browser does not get to choose another tenant's data.
Questions about this page go to support@coldsunenterprise.com. Policy version 2026-10-21, effective 21 October 2026.
Administrators sign in with Microsoft Entra. Helios asks Microsoft for multifactor authentication and rejects a Microsoft token, and any later Entra session, that does not carry the amr claim mfa. That check is on unless the deployment sets HELIOS_ENTRA_REQUIRE_MFA to false. Privileged roles are still rejected without the mfa claim.
Email and Google sign-in are for non-privileged roles. They do not pass through Entra. A separate authenticator can be required for those methods when HELIOS_AUTH_REQUIRE_MFA is true.
The full statement is the access-control policy kept with the Helios source.
A finance user sees what Plaid will access and must check an agreement before Plaid Link can open. Helios records the user, the time, and the privacy policy version.
Plaid client secrets stay in the deployment secret store. They are not written into the repository or returned to the browser.
Disconnecting a Plaid bank calls Plaid Item Remove when Helios holds that item, then deletes the stored balances and transactions.
Dependabot watches npm packages and GitHub Actions. CodeQL analyzes the JavaScript and TypeScript on pull requests and on main. Continuous integration runs pnpm audit and fails on a high or critical finding.
Patch targets are 7 days for critical, 30 days for high, and 90 days for medium. End-of-life runtimes and unsupported dependencies are reviewed before they drop out of security support.
Suspected security or privacy incidents are reported to support@coldsunenterprise.com. The privacy officer is Erik Wiltjer.
We contain the incident, remove the cause, restore service, and notify affected people and the Quebec and Canadian privacy authorities when the law requires it.