Legal center
The policies that govern how MissionHelm AI operates, protects data, and keeps the service useful for everyone.
Data Processing Agreement
Last updated: September 15, 2026. Draft — requires external legal review before it can serve as a final agreement. This draft applies when MissionHelm AI processes personal data on your behalf in providing the service. You are the data controller; MissionHelm AI is the processor for that data. Controller/processor roles for other activities follow the processor registry.
We process task, goal, plan, workspace, account, and related content only to provide, secure, support, and improve the service in accordance with your documented instructions and applicable law. Data subjects may include your users, employees, contractors, and collaborators. Personal data may include names, email addresses, account identifiers, and any personal data you choose to include in content. We process only on documented instructions unless required by law, in which case we inform you beforehand where permitted.
Categories and subjects are those in Section 4 of the Privacy Policy and the internal data inventory / RoPA for the contracted service. You instruct us not to process special-category or other restricted data beyond what the service expressly supports.
Personnel are bound by confidentiality. Controls include TLS in transit, provider-managed encryption at rest, AES-256-GCM for stored OAuth tokens and 2FA secrets only, Argon2 password hashing, least-privilege access, audited admin and impersonation access, and privacy-safe logging with defined retention. HMAC-signed backups provide integrity, not confidentiality. No absolute security is promised.
We may use cloud hosting, a database provider, a payment gateway, AI providers, and an email service to operate the service. These providers process data only as needed for their services and under contractual confidentiality and security obligations. Data may be processed in the United States and other locations where our providers operate, subject to appropriate safeguards where required (e.g. Standard Contractual Clauses for EU/EEA transfers). The subprocessor list is versioned; material changes are notified in advance with an objection mechanism under the final agreement.
If we confirm a personal-data breach affecting your data, we will notify you without undue delay and provide available information to support your obligations, including triage per DPDP (affected principals without delay; Board detail within 72 hours as specified), GDPR (risk-based 72-hour authority notice; high-risk individual notice), and California matrices. We assist with data-subject requests, DPIAs, and audits by providing relevant records and access as agreed in the final DPA.
Upon termination, we will delete or return customer personal data in accordance with our retention practices, unless applicable law requires retention — preserving only the minimum legally required with documented exceptions. Government-request handling, liability allocation, and DPA-vs-terms precedence will be fixed in the final agreement after legal review. Signed custom DPAs are available on request for procurement and security review via our contact channel.
Service Level Agreement
Last updated: August 26, 2026. This lightweight SLA applies only to paid plans and is an early-stage commitment intended to be clear rather than overpromising.
Target availability
99.5% monthly
Support response
Paid: 2 business days · B2B: 1 business day
Downtime means a material inability to access the production service, excluding scheduled maintenance announced in advance, customer connectivity issues, third-party failures outside our reasonable control, and events of force majeure.
For a verified failure to meet the target, paid customers may request a modest service credit. Credits are the sole remedy under this SLA, are capped at the affected month's fees, and do not apply until a paid B2B offering is available.
Acceptable Use Policy
Last updated: August 26, 2026. This policy complements the Terms of Service and helps us protect our users, systems, and partners.
You may not use MissionHelm AI to create, upload, or distribute abusive, harmful, or illegal content; violate another person's rights; scrape or harvest service data; reverse engineer or probe the service; resell or share access without authorization; bypass limits or security controls; or overload, disrupt, or interfere with the service or its infrastructure.
When appropriate, our enforcement path is warning, temporary suspension, then termination. We may skip steps when conduct creates urgent risk, is unlawful, is repeated, or threatens the security or availability of the service.
If you believe an action was taken in error, contact [email protected] with your account email and relevant context. We will review the appeal in good faith.