Documentation

The three pieces

Helix is a background service, a desktop app, and an optional cloud account. The seam between them is worth understanding once, because most confusion is really a question about which piece is doing what.

• The service does every measurement and owns the local database. It starts with Windows and runs whether or not anyone is signed in.
• The desktop app is a viewer. It connects to the service over a local pipe and starts nothing; closing it stops nothing.
• The cloud account is optional. Without one, the agent still measures and still diagnoses — you just have no history across devices and nothing to share.

1. Install the agent

Download the installer and run it. You will see a SmartScreen warning because it is not code-signed, and an administrator prompt because it registers a service. Both are explained in full on the download page — please read that before clicking through, rather than after.

You should see:

• Helix Internet Monitor in Start Menu and in Add/Remove Programs.
• A service called HelixCoreService, state Running, startup type Automatic. Check with Get-Service HelixCoreService if you want to be sure.

2. First run

Open the app. It should show your active connection identified by network operator within a few seconds — that is the app successfully talking to the service. Measurement windows begin accumulating immediately.

Numbers will be sparse at first, and the interface will say so rather than pretending otherwise. The canonical loss window is five minutes at one probe per second, so a loss figure worth trusting is about five minutes away; before that it is labelled coarse. Give it an hour before drawing conclusions about anything intermittent.

Nothing leaves the machine at this point. Cloud sync is off until you enrol the device in step 4.

3. Create an account

Go to monitor.helixaicloud.com and register with an email and password, or with Google. This account is what gives you history beyond the local machine, the ability to share with an ISP, and tickets.

A new account is on the free tier, which serves three days of readable history. Measurements are physically kept for 30 days on every tier, so if you upgrade later the history is already there.

4. Connect this device

The agent needs a device token before it will upload anything. Tokens are issued from the dashboard, one per machine.

1. In the dashboard, open Devices and choose Enrol this computer.
2. Copy both the server address and the token. The token is shown once — the server keeps only a hash of it and there is deliberately no way to resend it. Lose it and you revoke the device and enrol again.
3. In the desktop app, open the Account tab, paste both, and press Connect.

You should see: the app switches to connected and the dashboard's Devices list shows the machine with a recent last-seen. Any windows the service already measured upload as a backlog, so a machine that has been running for a while populates its history rather than starting from now.

No restart is needed at any point — the service watches the stored credential and starts syncing in place. Disconnecting is symmetrical.

5. Share with your ISP

This step is entirely optional and nothing about it is on by default.

1. In the dashboard, find your ISP and enter the account or service number they issued you. It is validated against the format that ISP registered, so a typo is caught rather than silently linking you to nothing.
2. Choose which connection the link applies to. If you run Helix on more than one line, only the one you pin is in scope.
3. Turn sharing on for that link.

What they then see: latency, packet loss, outages and speed tests for that line. Not your browsing, not what you use the connection for, not per-application data — none of which is uploaded at all.

Turning it off: flip sharing off and their next query returns nothing. There is no cache to expire. You disappear from their subscriber list entirely rather than appearing as revoked. More on revocation →

6. Raise a ticket

Once a link exists, you can open a ticket with your ISP from the dashboard. It arrives in their portal tagged with the service ID they know you by, alongside the live quality view for your line, so the conversation starts from evidence rather than from “when did this begin”.

In this release, attaching a full diagnosis report to a ticket is manual — export the report and send it, or paste the published link. The one-click attach button is not enabled yet.

7. Run a diagnosis

The Link Troubleshooter runs twelve stages from your network adapter out to the destination and produces a verdict with its confidence, the evidence supporting it, and the evidence arguing against it. It is offered automatically after an outage clears, and you can start one any time.

It takes up to about three minutes with a speed test, under a minute without. Stages that cannot run — the Wi-Fi radio stage on a wired machine, for instance — are reported as skipped with the reason, never quietly dropped.

When it finishes you can save the report as HTML, or publish it at an unguessable link you can revoke later. Publishing itemises what the report contains first, and lets you mask your public IP and hide hostnames before anything is uploaded.

Two things worth knowing about the verdict. “Inconclusive” is a real answer the engine is allowed to give and it means what it says. And because Wi-Fi radio telemetry is not implemented yet, that missing stage counts as contradicting evidence — so a machine on poor Wi-Fi reaches “inconclusive” more often than it should. That is the honest behaviour and it is still annoying.

For ISP operators

Onboarding an ISP organisation is not self-service in this release. The sequence is: verification that you operate the network you are claiming, deriving the validation pattern for your account numbers from real examples, creating the organisation, and inviting your support desk. The overview is on the ISP page, and the detail is walked through on the onboarding call.

Your desk's accounts carry capability-based roles — NOC, support, CRM, billing, read-only. A role is a set of capabilities, not a job title, and routes ask for the capability. A CRM agent can look up a service ID and read tickets and holds no quality permission at all, because consent was given for support purposes.

For the machine-to-machine integration, your network-management system is the client and always dials Helix; Helix never dials out to you. The data half of the contract is published as JSON Schema at contract.schema.json so you can generate types from it. More on the integration →

When something is wrong

The app says it cannot reach the service

Check the service is running: Get-Service HelixCoreService. If it is running and the app still cannot reach it, this is the pipe permissions path — it is the one failure that only appears after a real install, because it cannot happen when the service is run from a terminal. The service log records the permissions Windows actually attached to the pipe, which is the thing to compare against.

Nothing is uploading

Open the Account tab. If it shows not connected, the token was never stored or was cleared. If it shows connected but the dashboard's last-seen is stale, the token has probably been revoked or the account's database was reset — uploads then fail with an authorisation error. Revoke the device in the dashboard, enrol again, and paste the new token.

If the app refuses to let you change the credential at all, this machine has the environment-variable override in force — a fleet image or a support engineer pinned it deliberately, and it is meant to survive somebody opening the Account tab. The app will say so rather than appearing to succeed.

My ISP rejects my correct account number

The validation pattern comes from examples that ISP supplied at onboarding. If yours is a legitimate format their pattern does not cover, it is the pattern that is wrong. Tell them, or tell us — the fix is on our side, not yours.

My ISP is not in the list

Then they have not onboarded. The agent still measures everything and the Link Troubleshooter still produces a report you can export and send them by any route you like — it is designed to be readable by someone who has never heard of Helix.

A ticket email never arrived

Ticket mail is plain text carrying the reference, the service ID and a link. It is the kind of message aggressive spam filtering eats. Check the portal directly, and check the junk folder.

PDF export returns an error

PDF rendering needs a service that may not be configured on this deployment; when it is not, the API says so explicitly rather than producing a broken file. Export HTML and print to PDF from the browser.