# Trust and security > How 1Helm protects your work: encrypted in transit and at rest, private AI defaults, approvals and clear controls over your data. ## Your work is yours. *We keep it that way.* Your helper works with your conversations, files and connected apps. That calls for straightforward protections, clear choices and honest answers about who handles your data. ## Protected by default - **Encrypted in transit and at rest.** Your workspace data is encrypted while moving and while stored on Cloudflare. - **Private AI by default.** 1Helm-routed AI requests use Zero Data Retention unless you choose otherwise. - **Your request and permissions set the scope.** Ordinary requested app work runs directly; payment and API-key operations retain protected approvals. - **Your data is not for sale.** We do not sell your chats or files or train AI models on them. ## Data stored with *ISO 27001-certified providers.* Cloudflare and Hetzner maintain independently certified information-security management systems. Here is what their certifications cover. ### Cloudflare Cloudflare, Inc. hosts 1Helm's app and workspace storage. Its ISO certification covers its global cloud platform and offices; its SOC 2 Type II report assesses security, confidentiality and availability controls. - **ISO/IEC 27001:2022** — ISMS certification - **SOC 2 Type II** — Independent attestation [Cloudflare compliance resources ↗](https://www.cloudflare.com/trust-hub/compliance-resources/) ### Hetzner Hetzner hosts 1Helm's memory service. Its ISO certification covers hosting services and data centers, with certified locations in Germany and Finland. Hetzner Cloud also has a BSI C5 Type 2 attestation. - **ISO/IEC 27001:2022** — ISMS certification - **BSI C5 Type 2** — Cloud-service attestation [Hetzner information security ↗](https://docs.hetzner.com/general/company-and-policy/information-security-at-hetzner/) These are the providers' certifications and attestations, not 1Helm's. They apply to the systems, services and locations in each provider's published scope—not every individual server or every service connected to your helper. Cloudflare and the Cloudflare logo are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. ## A private default. *Your choice from there.* Zero Data Retention is the default for AI requests 1Helm routes, including background work. Every plan offers the same three settings. ### Zero Data Retention Only providers with verified coverage for your requests. Some models and discounts are unavailable. ### No Training Providers do not train on your requests, but may retain them briefly under their policies. ### Unrestricted Also allows eligible providers that may retain requests or use them to improve or train models. These settings do not change the policies of connected apps. If you use your own AI key, that provider's terms govern the AI part; Sign in with OpenRouter passes your privacy choice along. [How AI data privacy works ↗](https://1helm.com/docs/privacy/ai/) ## What protects your work. Simple on the surface. Specific where it matters. ### Encrypted in transit and at rest The hosted app uses HTTPS, and Sentinel requires HTTPS for every external web request from your helper's computer. Cloudflare encrypts stored conversations, files and account data. Saved passwords and API keys are encrypted separately from chats and files. [Privacy Policy ↗](https://1helm.com/privacy/) [Sentinel details ↗](https://1helm.com/docs/security/sentinel/) ### Keys stay outside the computer Your helper's computer sees a stand-in for a saved API key, not the real value. Sentinel, which runs outside that computer, reveals the key only on a request to its bound site. [How stand-in keys work ↗](https://1helm.com/docs/security/sentinel/#stand-in-keys) ### Protected actions wait for you Ordinary app work you request, including sends and edits, does not need another confirmation. Payment and API-key operations retain exact-action confirm cards, and purchases through Link need your approval there. Your helper cannot approve its own card. Stricter permission levels in Settings can require additional asks. [Approvals and permissions ↗](https://1helm.com/docs/approvals/) ### You control what stays connected You choose which apps to connect and can disconnect them. Composio holds their connection tokens; on 1Helm's plan, it keeps copies of app requests and responses for up to a year. Self-managed uses your own Composio account. [Connected-app details ↗](https://1helm.com/docs/apps/managed/) ## Read it for yourself. The product docs and policies behind this page. [Privacy Policy](https://1helm.com/privacy/) — Storage, service providers, deletion and your rights. [AI data privacy](https://1helm.com/docs/privacy/ai/) — Zero Data Retention, No Training and Unrestricted. [Sentinel](https://1helm.com/docs/security/sentinel/) — External web requests, protected keys and limits. [Approvals](https://1helm.com/docs/approvals/) — What waits for your OK and how to change permissions. ## Plain answers. ### Does encryption mean no service can read my data? No. Encryption in transit and at rest is not end-to-end encryption. 1Helm and the services you choose process information needed to carry out your requests. Optional [diagnostic access](https://1helm.com/docs/privacy/diagnostics/) lets 1Helm inspect filtered, retained records and evaluate them with support and AI tools it chooses, including non-ZDR tools, after you enable it and confirm by email. It is off by default; your in-app AI data privacy choice does not govern those tools. Our [Privacy Policy](https://1helm.com/privacy/) explains what they handle. ### Can my helper's computer use an HTTP-only site? Not through its web-request path. Sentinel blocks non-HTTPS external requests, including reads and redirects from HTTPS to HTTP. Direct SSH and managed Tailscale have separate network permissions. [Read about Sentinel.](https://1helm.com/docs/security/sentinel/) ### Do you or your AI providers train on my data? 1Helm does not itself train on your chats or files. Your helper's AI requests use Zero Data Retention by default; you can choose No Training or Unrestricted instead. With your own AI key, that provider's terms apply unless you sign in with OpenRouter, which passes your privacy choice along. Separately consented [diagnostic sharing](https://1helm.com/docs/privacy/diagnostics/) permits support and AI tools chosen by 1Helm, including non-ZDR tools, under their own terms and any permitted model improvement or training. Your in-app AI privacy choice does not govern those tools. [See the choices.](https://1helm.com/docs/privacy/ai/) ### What happens when I delete my account? Deleting it in Settings removes your 1Helm workspace immediately. Cancelling instead leaves it active until your paid period ends, then removes it. Billing records remain as long as law requires, and connected services have their own retention policies. [See deletion details.](https://1helm.com/docs/billing/cancel/) ### Where is my data hosted? Cloudflare hosts the app, conversations, channel computers, files and database. AI providers, connected-app services and payment services handle their specific parts. Data may be processed in the United States and other countries; we do not claim US-only hosting. [See the provider list.](https://1helm.com/privacy/) ## Tell us directly. Email [support@1helm.com](mailto:support@1helm.com). Please report vulnerabilities privately so we can investigate. --- Web page: https://1helm.com/trust/