Level 1 PCI-DSS service provider
Level 1 PCI-DSSHelcim maintains the highest tier of PCI compliance through rigorous on-site audits, vulnerability scanning, penetration testing, and adherence to NIST security practices.
Security & compliance
AETHRAFORM uses Helcim as its payment processor specifically because of its security posture. Helcim is a Level 1 PCI-DSS compliant service provider — the strictest tier defined by the Payment Card Industry — and the practice operates under a Helcim HIPAA Business Associate Agreement.
The page below summarizes the security controls Helcim documents publicly. For our official record, see Helcim's security page at helcim.com/security.
The technical safeguards Helcim applies to every transaction handled on our behalf.
Helcim maintains the highest tier of PCI compliance through rigorous on-site audits, vulnerability scanning, penetration testing, and adherence to NIST security practices.
All sensitive merchant and cardholder data — including names, card numbers, expiry dates, and cardholder addresses — is stored with AES-256 encryption.
Card data moves between your device and Helcim only over TLSv1.2 connections with strong cyphers. Outdated SSLv3, TLSv1.0, and TLSv1.1 are explicitly excluded.
When you save a card for a treatment plan, Helcim returns a one-way token. We can charge that token for follow-up visits without ever seeing or storing the underlying card number.
HelcimPay.js renders the payment form inside a Helcim-controlled iframe. Card numbers, expiry, and CVV are typed directly into Helcim and never traverse the practice’s servers.
Multi-factor authentication is required for all Helcim staff accessing production systems and is available to every merchant operating the dashboard.
Production infrastructure sits behind firewalls with intrusion detection and prevention systems, with continuous monitoring of suspicious activity.
Helcim runs daily automated backups stored across multiple data centers and offsite, protecting transaction records against single-region failures.
PCI-DSS prohibits long-term storage of these data elements. Helcim does not retain them at any point in the transaction lifecycle.
HIPAA
Healthcare merchants need a Business Associate Agreement (BAA) with any vendor that could touch protected health information. Helcim signs HIPAA BAAs on request, and AETHRAFORM operates under that BAA. Any payment-related personal data exchanged with Helcim — including names tied to medical procedures — is covered by HIPAA safeguards.