1. Purpose
Helios is a private identity, authentication, authorization, and access-management service operated by LoArt & Dev.
Helios is available at https://auth.loart.dev and provides identity and access services for private applications made available to authorized members of LoArt & Dev.
Because Helios is responsible for authentication and access control, the confidentiality and integrity of user accounts and authentication information are important to the security of Helios and every connected application.
This Security Policy describes the security principles used by Helios, the responsibilities of authorized users, and how suspected vulnerabilities or security incidents should be reported.
The current version of this policy is publicly available at:
https://loart.dev/legal/helios-security-policy
2. Scope
This Security Policy applies specifically to Helios, including:
- Helios user accounts;
- authentication systems;
- sessions;
- multi-factor authentication;
- passkeys and WebAuthn;
- recovery mechanisms;
- OpenID Connect and OAuth functionality;
- roles and permissions;
- connected application authorization;
- administrative functionality;
- security and audit records; and
- infrastructure directly supporting Helios.
Other LoArt & Dev services may have additional security requirements.
3. Security Principles
Helios is designed around several core security principles.
Least Privilege
Users and applications should receive only the access reasonably necessary for their intended purpose.
Deny by Default
Access should not be assumed merely because an account exists. Applications, roles, permissions, and administrative capabilities should require explicit authorization.
Application-Scoped Authorization
Administrative or privileged access to one connected application does not automatically provide equivalent access to another application or to Helios itself.
Defense in Depth
Helios may use multiple security controls rather than relying on a single protection.
These controls may include authentication requirements, MFA, passkeys, secure sessions, authorization checks, rate limiting, cryptographic protections, audit logging, and infrastructure-level safeguards.
Security Auditing
Security-relevant actions may be recorded to assist with troubleshooting, investigation, and detection of unauthorized activity.
4. Account Security
Authorized users are expected to take reasonable precautions to protect their Helios accounts.
Users should:
- use a strong and unique password;
- protect authentication devices;
- protect passkeys and authenticator applications;
- keep recovery codes private;
- avoid sharing credentials;
- review suspicious login or security activity;
- terminate sessions they no longer recognize or use; and
- report suspected account compromise promptly.
Authentication credentials should never be intentionally shared with unauthorized persons.
5. Password Security
Helios does not intentionally store user passwords in plaintext.
Passwords are intended to be processed using password-hashing mechanisms designed for secure credential storage.
Users should avoid reusing their Helios password on unrelated services.
Helios administrators should not ask users to disclose their current password.
6. Multi-Factor Authentication
Helios may support or require multi-factor authentication for some users or operations.
Users who enable MFA are responsible for protecting:
- authenticator devices;
- authenticator secrets;
- recovery codes; and
- other recovery mechanisms.
MFA may be required for administrative or otherwise security-sensitive accounts.
7. Passkeys and WebAuthn
Helios may support passkeys and WebAuthn authenticators.
Passkeys are intended to provide strong, phishing-resistant authentication where supported.
Users are responsible for maintaining appropriate control over devices, password managers, hardware security keys, or other systems containing their passkeys.
Lost or compromised authenticators should be removed from the account as soon as reasonably possible.
8. Recovery Codes
Recovery codes or similar emergency authentication credentials should be treated as sensitive authentication secrets.
Users should:
- store recovery codes securely;
- avoid sending them through ordinary messaging systems;
- never publish them;
- regenerate them if exposure is suspected; and
- avoid storing them somewhere accessible to unauthorized persons.
Helios administrators should not ask users to provide their recovery codes.
9. Sessions
Helios may maintain authenticated sessions across supported devices and browsers.
Users should terminate sessions associated with devices they no longer control.
Helios administrators may revoke sessions when reasonably necessary because of:
- suspected account compromise;
- credential changes;
- security incidents;
- account suspension;
- administrative action; or
- other security concerns.
10. Email and Security Communications
Helios may send transactional and security-related email concerning:
- email verification;
- password recovery;
- password changes;
- new or suspicious authentication activity;
- MFA changes;
- passkey changes;
- recovery changes;
- account changes; and
- other security events.
Transactional messages may originate from dedicated LoArt & Dev transactional email infrastructure, including addresses using the transactional.loart.dev domain.
The exact sender address may change as LoArt & Dev's email infrastructure evolves.
Users should therefore not rely exclusively on a specific sender address as proof that an email is legitimate.
Helios will never intentionally request that users send their password, MFA secret, passkey private material, or recovery codes by email.
For assistance or to verify a suspicious communication, contact:
11. Phishing and Suspicious Messages
Users should exercise caution with messages claiming to originate from Helios or LoArt & Dev.
Before entering credentials, users should verify that authentication is taking place through the expected Helios service at:
Users should not enter Helios credentials into unrelated websites.
Suspicious messages, unexpected authentication prompts, or suspected phishing attempts should be reported to:
12. Connected Applications
Helios provides authentication and authorization to connected private applications.
Connected applications receive only the identity and authorization information appropriate for their integration and granted access.
Helios authentication secrets such as password hashes, MFA secrets, recovery codes, and private passkey material are not intended to be disclosed to connected applications.
Compromise of a connected application should not automatically grant administrative access to Helios.
13. Administrative Security
Helios administrators have elevated responsibilities.
Administrative access should be used only for legitimate operational, support, maintenance, access-management, or security purposes.
Administrative users should use stronger authentication protections where available.
Administrative actions may be recorded in security and audit logs.
Administrative privileges should be removed when no longer necessary.
14. Security and Audit Logging
Helios may record security-relevant events including:
- successful and failed authentication;
- session creation and revocation;
- password changes;
- email verification;
- MFA changes;
- passkey changes;
- recovery-code changes;
- application access changes;
- role and permission changes;
- administrative actions; and
- suspicious or blocked activity.
Audit records are intended to support security, troubleshooting, accountability, and incident investigation.
Access to security records should be restricted to authorized persons.
15. Rate Limiting and Abuse Protection
Helios may use rate limits and other abuse-prevention mechanisms to protect authentication, recovery, email, and other sensitive operations.
Attempting to intentionally bypass or defeat these protections is prohibited except where explicitly authorized for security testing.
16. Vulnerability Reporting
If you believe you have discovered a security vulnerability affecting Helios, report it privately to:
A useful report should include, where possible:
- a description of the issue;
- the affected feature or URL;
- steps necessary to reproduce the issue;
- the potential security impact; and
- any relevant screenshots, logs, or other evidence that can be safely shared.
Do not include passwords, MFA secrets, recovery codes, private keys, or unnecessary personal information in a vulnerability report.
17. Responsible Security Testing
Authorized members of LoArt & Dev may report security issues discovered through normal use.
Security testing beyond normal use should be performed only with authorization.
Unless explicitly authorized, users must not:
- access another user's account;
- extract another user's information;
- intentionally disrupt Helios;
- perform denial-of-service testing;
- deploy malware;
- perform destructive testing;
- intentionally bypass authorization boundaries;
- attempt to obtain authentication secrets belonging to others; or
- continue exploiting a vulnerability after enough information has been obtained to report it.
Good-faith, authorized security testing is encouraged when coordinated appropriately.
18. Security Incidents
If Helios administrators become aware of a security incident, reasonable steps may be taken to:
- investigate the incident;
- contain unauthorized access;
- revoke sessions or credentials;
- temporarily disable accounts or functionality;
- reset or rotate affected credentials;
- preserve relevant security records;
- correct vulnerabilities; and
- notify affected users where appropriate.
Security controls may be temporarily tightened during an active incident.
19. Account Compromise
If you believe your Helios account has been compromised:
- Change your password if you can safely access the account.
- Review and revoke unfamiliar sessions.
- Review MFA methods and passkeys.
- Regenerate recovery codes if compromise is suspected.
- Contact support@loart.dev promptly.
If you cannot access your account, contact support directly.
20. No Guarantee of Absolute Security
Reasonable efforts are made to operate Helios securely.
However, no computer system, authentication mechanism, network, or software application can be guaranteed to be completely secure.
This Security Policy describes security practices and expectations and does not constitute a guarantee that security incidents will never occur.
21. Changes to This Security Policy
This Security Policy may be updated as Helios's architecture, authentication mechanisms, or security practices change.
The Last Updated date at the beginning of this document identifies the current version.
The canonical current version is available at:
https://loart.dev/legal/helios-security-policy
22. Related Documents
Use of Helios is also governed by the applicable:
- Helios Privacy Policy;
- Helios Terms of Service; and
- LoArt & Dev Acceptable Use Policy.
Current legal documents are publicly available at:
23. Contact
For Helios support, account-security concerns, suspicious communications, or vulnerability reports, contact:
The primary LoArt & Dev website is:
Helios is available at: