Version 1.2 · Effective July 24, 2026
Helmsted engages the third-party subprocessors below to deliver the platform. Before engaging a subprocessor we review its security documentation and published attestations, scope its access to the minimum the service requires, and bind it to a written agreement with data protection obligations no less protective than our DPA, including the obligation to notify us of security incidents. Your firm receives at least 30 days' advance written notice of material changes to this list, with the right to object.
Hosting and serving of the Helmsted API and web application: compute, edge routing, and TLS termination. Does not persistently store client financial documents.
United Statesvercel.comHosting of the Helmsted agents service, which orchestrates agent execution and streams session events. Does not persistently store client financial documents.
United Statesrender.comCloud hosting and infrastructure services supporting the Helmsted platform. Does not persistently store client financial documents.
United Statescloud.google.comManaged PostgreSQL database, authentication, and identity and session management. Stores adviser client data at rest: financial document metadata, planning outputs, audit logs, user credentials, and session data.
United States (US West, Oregon)supabase.comAI API provider (Claude). Processes adviser and client data during agent sessions under a Zero Data Retention agreement: no input or output data is retained after an API call completes, and data is never used for model training.
United Statestrust.anthropic.comAI API provider. Processes adviser and client data during agent sessions under a Zero Data Retention agreement: no input or output data is retained after an API call completes, and data is never used for model training.
United Statesopenai.comAI API provider. Processes adviser and client data during agent sessions under a Zero Data Retention agreement: no input or output data is retained after an API call completes, and data is never used for model training.
United Statesx.aiSecure sandbox execution environments in which the Helmsted agent runs code and processes adviser-submitted documents during a session. Data does not persist after the session ends.
United Statestrust.e2b.devObject storage (Cloudflare R2) for adviser-uploaded documents and agent-generated artifacts stored at rest.
Eastern North Americacloudflare.comManaged event delivery and workflow orchestration. Routes and triggers the services that drive Helmsted agent sessions; event payloads may include references to adviser and client data and excerpts of session context.
United Statesinngest.comTransactional email delivery: platform notifications, authentication emails, and system alerts to adviser users. Does not receive client nonpublic personal information or client financial data.
United Statesresend.comAccount aggregation for the client portal. When a client chooses to connect an external financial account, Plaid retrieves account information on the client's behalf. Used only for client-initiated aggregation; institution credentials are handled by Plaid through secure tokenized methods and are not stored by Helmsted.
United Statesplaid.comWeb data extraction and crawling used to retrieve publicly available web content for the platform's research and analysis features. Does not receive client nonpublic personal information or client financial data.
United Statesfirecrawl.devNotes for reviewing firms
Client data at rest is concentrated in the managed database (Supabase) and object storage (Cloudflare R2); all other subprocessors handle client data only transiently during a session.
Helmsted's AI API providers (Anthropic, OpenAI, and xAI) are each subject to a Zero Data Retention agreement. Plaid is engaged only for optional, client-initiated account aggregation in the client portal.
The authoritative version of this list is Exhibit A of the Helmsted Data Processing Addendum. Your firm's designated compliance contact receives at least 30 days' advance written notice of material changes. For any question about a subprocessor, write to security@helmsted.ai.
Changelog
1.2 (July 24, 2026): Current 13-vendor list in effect.
1.1 (June 27, 2026): Data Processing Addendum updated to the 13-vendor list.
1.0 (April 27, 2026): First published list (9 vendors). Fly.io was later replaced by Render Services. The Anthropic arrangement was upgraded from an enterprise no-training agreement to Zero Data Retention.