See the line the way your customer sees it.
Your monitoring watches the network from the inside. Helix watches the same line from the subscriber's PC — thousands of probes an hour, exact counts, from the far end of the last mile. When the two disagree, that disagreement is diagnostic. When they agree, the argument is over.
You see customers who chose you. Nobody else, and nothing else.
The paragraph we read to every support desk: You will only ever see data for customers who install Helix, enter their account number with you, and switch sharing on. They can switch it off at any time and you lose visibility immediately. You will see latency, packet loss, outages and speed tests for their line — not their browsing, not what they use the connection for.
Two gates, and they are separate
Consent asks whether this subscriber said yes and has not withdrawn it. Scope asks which of that subscriber's connections you may see. Both are live database predicates evaluated on every read, so revocation takes effect on the next query rather than on the next sync.
Both fail closed. Each lives in exactly one module so that widening either one shows up in a code review and breaks a test.
What scope means if you have no ASN
For an AS operator, scope is your ASN: a customer who also runs Helix on an office line served by someone else is not in your view and never will be.
For a reseller or a carrier-grade-NAT operator with no ASN of your own, scope is the connection the subscriber explicitly pinned to you. Unpinned serves nothing — we would rather show you an empty row than someone else's customer.
A revoked subscriber disappears
Not greyed out, not marked revoked, not retained as a tombstone. An ISP has no business knowing that somebody used to share with it.
Roles are capabilities, not job titles
Every route asks for a capability. A CRM agent can look up a service ID and read tickets but holds no quality permission at all; billing sees billing. Consent was given for support purposes, so a design that lets a billing clerk browse connection history is a failed design, not a trade-off.
Four screens your desk will actually use.
| Screen | What is on it | What it is not |
|---|---|---|
| Subscribers | One row per live link: service ID, whether the link is confirmed or subscriber-asserted, whether sharing is on, and last-seen when it is | Not a customer list. It is a list of people who chose you |
| Subscriber detail | Loss, latency, jitter, derived outage spans and recent speed tests over 24 hours, 7 days or 30 days — recomputed from raw probe counts, not from stored averages | Not browsing history, not traffic, not per-application data. None of that is ever uploaded |
| Ticket queue | Tickets your own subscribers raised against you, each tagged with the service ID you know them by | Not a general inbox |
| Ticket detail | The thread, status controls, and the diagnosis report when one is attached | — |
Every ticket arrives with its own evidence.
A subscriber-raised ticket carries the rolling pre-fault history, recent path snapshots, connection re-key events, the carrier-grade-NAT flag and the service ID — so the first question your desk asks is not “when did this start and what were you doing”.
The number you get is re-aggregatable
Quality reads return counts and histograms with the vantage point stamped on every value — never a percentage. Ask for a different window and it is recomputed from the raw counts, so two windows you pull can be combined without producing a number that means nothing.
Attribution you cannot backdate
A maintenance window only suppresses fault attribution if it was declared at least 15 minutes before the fault. A window declared afterwards is still recorded, and still shown — hatched, and visibly distinct from a planned one. The rule exists because without it the feature inverts into a retroactive amnesty.
Advisory signals do not act
When a connection sustains more throughput than the plan you provisioned, Helix flags the binding as possibly stale — and unpins nothing. A plan upgrade you have not mirrored yet reads identically, and a background job quietly tearing down a correct link would look exactly like the outage the customer just called about.
Verdicts carry their counter-evidence
Every diagnosis renders what supports it and what argues against it, both, always. Your engineers get to disagree with the conclusion using the same evidence that produced it, which is the only kind of verdict worth sending to a NOC.
Your NMS is the client. Helix never dials out.
Every connection is opened by your system toward Helix over HTTPS. Helix exposes nothing that reaches back into your network, and there is no design in which it makes an outbound call to a hostname you control — that would be a request-forgery primitive, and refusing to build it costs nothing.
A published contract, not a description
The data half of the contract is served as JSON Schema, unauthenticated, so you can generate types instead of copying a document into your repository.
Its governing rule: the schema is never stricter than the receiver. Where Helix tolerates a value rather than refusing it — an over-long label is truncated, a nonsensical rate is stored as absent — the schema says so and encodes no constraint, because a schema that refuses what the server accepts teaches your client to expect refusals that never come.
Telemetry is pulled, never exported
Subscriber telemetry is read per service and time-bounded. It is never bulk-exported and never replicated into a store you operate — because the moment a copy lives in your database, revocation stops being a code guarantee and becomes a contract term.
Binding, confirmation and consent are three facts
You assert the binding between a service and a connection. You confirm the claim. Only the subscriber grants consent. Three writers, deliberately: bulk-loading your fleet must not auto-confirm links, and confirming a link must not grant telemetry.
The binding channel carries no personal data at all, which is why it needs no consent conversation. Service IDs must be opaque, and labels must not carry an address, a name, a phone number or an account number.
The rate limit, said out loud
Quality reads are rate-limited. At the contract's limit a full sweep of ten thousand subscribers takes several minutes, so fleet-wide subscriber-side quality cannot be rendered under this contract — render per device on demand. We would rather you read that here than discover it in production.
What onboarding involves.
-
Verification
Proof that you operate the network you are claiming — a PeeringDB entry, an RIR object or a letter of authority — plus business verification, before any subscriber data flows. Resellers and CGNAT operators without an ASN are onboarded on the pinned-connection model instead.
-
Your service-ID format
We derive the validation pattern for your account numbers from real examples you provide, so a subscriber typing their own account number correctly is not told it is invalid.
-
Desk accounts
Your team is invited with capability-based roles — NOC, support, CRM, billing, read-only — and suspension is enforced at the authentication layer rather than by each route remembering to check.
-
Your first subscribers
They install the agent, enter the account number you issued them, and choose to share. Until somebody does, your subscriber list is empty — and that is the system working correctly.
What this does not do yet.
This list is on the public site on purpose. Everything here is real, current, and would otherwise be discovered in week one.
Coverage
- Windows only — no macOS, Linux, mobile or router agent, so mobile-first customers cannot take part.
- The installer is unsigned; every customer sees a SmartScreen warning.
- Wi-Fi radio telemetry is missing, so that diagnostic stage is skipped — and the gap counts as contradicting evidence, which means customers on bad Wi-Fi get “inconclusive” more often than they should.
Workflow
- No webhooks and no BSS/OSS connectors — nothing syncs into Sonar, Splynx, UISP or your CRM. Cross-navigation is copy-and-paste on the service ID.
- Scheduled recurring reports are not written yet; the portal is live instead.
- Ticket email is plain text with a link. Set up SPF, DKIM and DMARC or your filters will eat it.
- Per-hop country is registry country, not geolocation — never show it to a customer as a location.
Run a pilot.
Pricing for ISP organisations is quoted per opted-in subscriber with a monthly minimum. We would rather scope it against your subscriber count than publish a number that does not fit you.