Skip to content

Governance

Security

How StoryHelm safeguards your account and your manuscripts, the honest path your prose takes when you ask us to analyze it, and how to report a vulnerability. We never train on or sell your work.

Effective: · Last updated: This document's own dates. No other paper moves them.

In force
Contents

6 sections · about 5 min read

Security at StoryHelm

A courtesy, not the contract

StoryHelm is an AI manuscript-intelligence platform for indie series authors. It reads and analyzes your work; it never writes your prose. Authors trust us with unpublished manuscripts, so we are direct about how we protect them and honest about where they travel.

This page describes the safeguards we have in place today, our privacy posture, and how to report a vulnerability. We describe what is true now rather than aspirational claims, and we update it as our program matures.

The ledger

Where your manuscript rides

Encrypted in transit and at rest

  1. 01

    In transit: TLS 1.2 or higher, on every request.

    All traffic between your browser and StoryHelm is encrypted. We do not serve the application over an unencrypted connection.

  2. 02

    At rest: Encrypted storage, least privilege, production kept apart.

    Account data, manuscript content, and derived analysis are encrypted at rest. Access to production is role-based and granted on a need-to-know basis, and we do not build or test the product against your live manuscript.

  3. 03

    Under analysis: Read to produce your findings. Never used to train a model.

    Your manuscript text travels from your browser to our servers and on to Anthropic, PBC's Claude API, which returns the findings, canon, and translations you asked for. Neither StoryHelm nor Anthropic, PBC trains a model on your work. Training and retention are different things, and the section on your manuscript below is precise about both.

  4. 04

    On your word: Yours to keep, and yours to take back.

    You retain 100% of the copyright in your manuscripts, and our licence is the narrow one needed to host, process, and transmit them. Email [email protected] and we export or delete your data. We never sell your work.

Where this note and the sections below disagree, the sections govern.

Protections

Safeguards in place

Section 1
How we protect your data

We apply layered controls so that your account and your manuscripts are protected in transit, at rest, and in the systems that handle them.

  • Encryption in transit. All traffic between your browser and StoryHelm is encrypted using TLS 1.2 or higher. We do not serve the application over unencrypted connections.
  • Encryption at rest. Account data, manuscript content, and derived analysis are encrypted at rest in our cloud infrastructure.
  • Access controls and least privilege. Access to production systems is role-based and granted on a need-to-know basis. We follow the principle of least privilege, so people and services receive only the access required to do their job and nothing more.
  • Segregated environments. Development, testing, and production are kept separate. We do not use your live manuscript content to build or test the product.
  • Monitoring and review. We monitor for abuse and unusual activity and review our controls regularly as the platform evolves.

No method of transmission or storage is perfectly secure. We pair these controls with the steps below, and we ask that you protect your account with a strong, unique sign-in.

Section 2
Your manuscript

We believe authors deserve a clear answer about what happens to their words, so here it is in plain language.

When you run an analysis or a translation, the relevant manuscript text and the context derived from it are sent from your browser to our servers, hosted on DigitalOcean, and from there to Anthropic, PBC's Claude API. StoryHelm is the multi-agent system that produces your read: a 61-pass analysis across 7 workflows, powered by Claude. Your prose is processed to produce your findings, canon, and translations. We will never tell you it stays only on your device, because that would not be true.

No training on your work. Neither StoryHelm nor Anthropic, PBC trains any model on your manuscripts. Under Anthropic's commercial terms, the Claude API does not train on inputs or outputs by default.

Retention at the provider. Training and retention are different things. By default, Anthropic automatically deletes API inputs and outputs within 30 days of receiving or generating them. Some of our analysis runs through Anthropic's Message Batches API, which stores a batch's requests and results for up to 29 days after the batch is created. Prompt caching adds no stored copy of its own: Anthropic holds a temporary cache of repeated context in memory for five minutes, or up to one hour, and then deletes it. Anthropic may keep data longer where the law requires it, and if its automated safety systems flag content as violating its Usage Policy, it may keep those inputs and outputs for up to 2 years. We do not currently operate under a Zero-Data-Retention agreement, so we describe this honestly rather than claiming your text is never stored.

Analytics with your prose masked. Product analytics and session replay are consent-gated and off by default. When you do opt in, our recording tools are configured to mask manuscript and editor surfaces, so your prose is excluded from session recordings.

For the full list of providers and the role each one plays, see our Subprocessors page.

Section 3
Privacy by design

We build with privacy as the default rather than an afterthought.

  • Opt-out analytics by default. Non-essential cookies, product analytics, session replay, and marketing are off until you opt in. Essential cookies that keep you signed in and secure are the only ones that run without your consent.
  • Your work stays yours. You retain 100% of the copyright in your manuscripts. We take only a limited license to host, process, and transmit your content to the subprocessors that make analysis, collaboration, and translation work, and we never sell your work.
  • Data export and deletion on request. You can access, export, correct, and delete your data by emailing [email protected].

For the complete picture of what we collect and why, read our Privacy Policy.

Posture

Compliance, hosting, and disclosure

Section 4
Compliance posture

We are working toward SOC 2 Type II as our security program matures. This is a goal we are actively pursuing, not a completed certification, and we will update this page when our status changes. We will not claim audits we have not completed.

We support the data-protection rights described in our Privacy Policy and our GDPR & UK GDPR page, including access, correction, export, and deletion.

Section 5
Where data is hosted

StoryHelm is operated from, and your data is hosted on, cloud infrastructure in the United States (DigitalOcean). If you access the service from the European Economic Area, the United Kingdom, or another region, your information is transferred to the United States and to our subprocessors there.

Where required, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with appropriate technical and organizational safeguards, to protect those transfers.

Section 6
Responsible disclosure

If you believe you have found a security vulnerability in StoryHelm, we want to hear from you. Report it to [email protected] with enough detail for us to reproduce and validate the issue. Please give us a reasonable opportunity to investigate and remediate before any public disclosure.

Safe harbor for good-faith research.

We will not pursue or support legal action against security researchers who, in good faith, find and report vulnerabilities in accordance with this policy. To stay within scope, please:

  • access only accounts and data that you own or have explicit permission to test, and avoid accessing, modifying, or deleting other users' data, including their manuscripts;
  • avoid privacy violations, service disruption, and destruction of data; do not run denial-of-service tests, spam, or social-engineering attacks against our users or staff;
  • stop testing and report immediately if you encounter personal data, and do not retain, share, or use it; and
  • give us a reasonable time to remediate before disclosing the issue publicly.

Acting in good faith under these guidelines, your research is authorized and we will work with you to understand and resolve the issue quickly. If you are unsure whether a specific test is in scope, contact us at [email protected] before you begin.

Receipts

What we have actually done

Dated proof, not adjectives. Where we have nothing to show yet, this band says so rather than reaching for a reassuring word.

26 July 2026

A security remediation wave, shipped

A full review of the application and the API produced eight changes that shipped together on one day: JSON-LD escaping and a tighter production Content-Security-Policy, object-level authorization on export, bundle, and project transfer, hardening of the cover-image fetch against server-side request forgery, upload hardening against zip bombs and log injection, an overdraft gate tied to an active paid subscription, and a committed-secret scan wired into the pre-commit hook.

20 regression suites

Fixes that cannot quietly reopen

Every one of those repairs is pinned by an automated regression suite in the backend test tree. Each asserts the guard still sits in the handler that needs it, so a later refactor cannot remove it without failing a test.

24 June 2026

Object-level access checks, re-audited

An exhaustive re-audit found a class the earlier sweeps had masked: routes that checked the project on the path, then loaded a child record by its own id without confirming the record belonged to that project. Every one of them now confirms it before it reads or writes.

Not yet certified

SOC 2: a goal in progress

We are working toward SOC 2 Type II. We describe it as a goal in progress, not a completed or recurring audit, and we will not claim an audit we have not completed. This page changes when that changes.

Security questions

Security questions, answered

Is my manuscript secure with StoryHelm?

Yes. Your data is encrypted in transit (TLS 1.2 or higher) and at rest, access to production systems is restricted on a least-privilege basis, and analytics are consent-gated with your manuscript and editor surfaces masked from any session recording.

Does StoryHelm's AI provider train on my book?

No. Your prose is sent to Anthropic's Claude API only to produce your findings. Anthropic's commercial API does not train on inputs or outputs by default, and StoryHelm does not train on your work either. If you run the editor's grammar check, the text you check also goes to LanguageTool, which states it does not train on it.

Does StoryHelm have SOC 2?

We are working toward SOC 2 Type II. We describe it honestly as a goal in progress, not a completed or recurring audit.

Where is my data hosted?

StoryHelm runs on US cloud infrastructure. Where personal data leaves the UK or EEA, transfers are governed by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

How do I report a security vulnerability?

Email [email protected]. We support good-faith security research and will not pursue researchers who act responsibly and avoid accessing other users' data.

Related policies

StoryHelm · PO Box 352, Grantsville, UT 84029

Privacy & data requests: [email protected] · Legal: [email protected]

Effective July 5, 2026 · Last updated October 28, 2026. We notify you of material changes in-app and by email; continued use after an update constitutes acceptance.