Security & Trust
The controls security teams expect, stated plainly — most questionnaires can be answered from this page.
Compliance posture
| Standard | Status | Detail |
|---|---|---|
| SOC 2 Type II | in progress | Controls mapped (audit logging, encryption, RBAC, access reviews); an audit is engaged. The report is available under NDA on request once issued. |
| GDPR · DPA | available | A Data Processing Addendum (DPA) is available on request — see the link below. EU data residency is available on Business and above. |
| AES-256 · TLS | enforced | All secrets are encrypted at rest with AES-256-GCM; every connection is served over TLS. No plaintext credential storage, anywhere in the stack. |
| SSO / SCIM | supported | SAML & OIDC single sign-on (Okta, Microsoft Entra, Google) with JIT provisioning; SCIM user provisioning is available on Enterprise. |
Standards not yet listed here (ISO 27001, HIPAA) are on the roadmap — ask your account contact for the current timeline.
Controls
how each control actually works, not a badgeEncryption
All secrets (cloud credentials, tokens, MFA secrets) are encrypted at rest with AES-256-GCM. All traffic is served over TLS.
Access control
Fine-grained, provider-scoped RBAC with custom roles. Every tenant API call is server-authoritative; the UI gate is convenience only.
Authentication
SAML & OIDC single sign-on (Okta, Microsoft Entra, Google) with JIT provisioning; TOTP multi-factor authentication with an org-wide require-MFA policy and one-time backup codes.
Audit
Every mutating action is recorded to an immutable per-org audit log, exportable as CSV. Cross-tenant staff actions are separately audited.
Tenant isolation
Strict per-organization data scoping on every query; the database is the unit of isolation. Read-only credentials for cloud ingest — Nimbus never writes to your cloud in Safe Mode.
Network safety
All outbound integrations (webhooks, OpenCost, SCM/ticketing) pass an SSRF guard (HTTPS-only, private-IP & cloud-metadata blocklist, DNS rebinding pin). Rate limits on every public and LLM endpoint.
Sub-processors
who processes data on our behalf| Sub-processor | Purpose | Region |
|---|---|---|
| MongoDB Atlas | Primary application database | US / configurable |
| Cloud hosting (AWS/GCP) | Application + worker compute | US / configurable |
| Stripe | Subscription billing | US |
| Anthropic / OpenAI | AI assistant (grounded Q&A) — only the question + your aggregated cost figures are sent | US |
| Slack, GitHub, Jira | Optional, opt-in integrations you connect | Per vendor |
Data handling
- Residency
- Data is hosted in your configured region.
- Retention
- Cost data is retained for your plan’s history window; you can request deletion at any time.
- Portability
- Export billing (FOCUS), allocation, savings and audit logs as CSV or board reports whenever you like.