Your Data, Protected

Technical Security Measures

We implement multiple layers of protection to safeguard your data.

Authentication & Access Control

• Secure session management with automatic timeout
• Sessions stored in database with IP and User-Agent tracking
• Brute-force protection: account lockout after 5 failed login attempts (15-minute cooldown)
• Per-IP and per-account rate limiting on login endpoints
• Role-based access control (RBAC) with 4 permission levels: seller, region_manager, network_manager, superadmin
• CSRF protection on all state-changing API endpoints
• Google OAuth support for single sign-on (optional)

Data Protection

• AES-256-GCM field-level encryption for sensitive data at rest (transcripts, personal information, notes)
• TLS 1.2 or higher for all data in transit
• Server-side raw audio is removed after successful transcription; failed jobs, browser backlog, legal hold, quality review and backups may extend retention beyond the standard retry window
• Source transcript cleanup is scheduled after a five-minute safety window for new successfully analysed chunks; pending/retryable work and documented exceptions retain needed copies
• Bcrypt password hashing with salt
• Encryption keys managed via environment variables or secure persistent storage

Infrastructure Security

• Protected cloud environment for application services, persistent storage and encrypted backups
• MicHelper does not claim a product-level certification that it has not obtained
• Approved AI services operate under privacy and retention controls; specific provider routing is confidential
• Security headers via Helmet.js: CSP (with per-request nonce), HSTS, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection
• Global rate limiting: 3000 requests/minute per IP (default; env-tunable)
• Auth rate limiting: 200 requests/minute per IP on /auth/* endpoints
• Upload rate limiting: 300 requests/minute per IP, 180 requests/minute per user (default; env-tunable)
• Beacon / emergency upload rate limiting: 20 requests/minute per IP
• File upload validation: type, size limits (up to 500 MB for audio, 25 MB for other endpoints), path traversal protection
• Parameterized SQL queries to prevent injection
• XSS pattern detection on input
• Automated encrypted database backups with rotation (last 10 retained; AES-256-GCM)
• Independent technical security reviews by multiple engineers (no formal penetration-test certification is claimed)

Audit & Monitoring

• Comprehensive audit logging of access, modifications, and security events
• Transcript access logging (who viewed what, when)
• Login attempt tracking with IP information
• Error and security incident logging with configurable retention
• Sensitive data redaction in logs

Data Lifecycle

Privacy & Compliance

Designed for the current Ukrainian market with data minimisation, purpose limitation, controlled access and human review in mind.

Data Lifecycle & Retention

Audio Recordings

Raw audio is removed from server storage after successful transcription. Failed jobs, browser backlog, valid legal hold, quality review and backups have separate cleanup schedules; six hours is the standard retry window, not a guaranteed maximum.

Transcripts

For new recordings, source conversation text is encrypted while needed for analysis and retries. Cleanup for a successfully analysed chunk is scheduled after a five-minute safety window, subject to pending/retryable work, legal hold and backup exceptions. Historical text needs separate audited cleanup. Derived analysis and scores may remain.

Analytics, Scores & Performance Data

QA scores, coaching notes, event timelines and metadata can remain after raw audio and source text are removed. They follow the configured service retention and signed customer agreement and may remain personal data when linked to a worker.

Account & Configuration Data

User accounts, network configurations, scripts and settings follow configured retention, the signed customer agreement and applicable legal obligations.

Summary

Security Commitment & Limitations

MicHelper implements industry-standard security measures to protect your data, including but not limited to:

• HTTPS/TLS encryption for data in transit, AES-256-GCM for data at rest
• Deletion of raw audio after successful transcription, with a 6-hour maximum for failed-transcription retry copies
• Field-level encryption for sensitive data (transcripts, personal information)
• Secure password hashing (bcrypt with salt)
• Rate limiting and brute-force protection on all authentication endpoints
• CSRF protection on all state-changing operations
• Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via Helmet.js
• Role-based access control (RBAC) with principle of least privilege
• Automated data cleanup and retention enforcement
• Comprehensive audit logging of all access and modifications

No Absolute Guarantee. While we employ robust, multi-layered security controls and follow industry best practices, no system connected to the internet can guarantee 100% security. We commit to:

• Promptly investigating and addressing any security vulnerabilities discovered
• Notifying affected customers within 72 hours of confirming a data breach
• Continuously improving our security posture based on evolving threats
• Maintaining transparency about our security practices through this page

If you discover a potential security vulnerability, please report it responsibly to security@michelper.com. Do not access other users' data or publish technical details before we can investigate.

Vulnerability Disclosure

We value the security research community and welcome responsible disclosure of security vulnerabilities.

• Contact: security@michelper.com
• Response time: We will acknowledge receipt within 48 hours
• Scope: All MicHelper services at michelper.com
• Safe harbor: We will not pursue legal action against security researchers who follow responsible disclosure practices

Please do not access or modify other users' data, disrupt services, or publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.