Is this your company? Buyers are checking NimbleWork Inc here. Claim nimblework.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
NimbleWork Inc
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
NimbleWork Inc is SOC 2 Type II compliant. NimbleWork Inc also holds ISO 27001, and GDPR.
Compliance & infrastructure
Hosting
AWS
Documents
27Documents
- Data Privacy FrameworkPublic
- SOC 2 Type IIRequest
- ISO 27001:2022Request
- GDPR Compliance PolicyRequest
- Nimble Penetration Test Report WEB 2024-2025Request
- Nimble Penetration Test Report API 2024-2025Request
- SwiftKanban Penetration Test Report WEB 2024-2025Request
- SwiftKanban Penetration Test Report API 2024-2025Request
- kAIron Penetration Test Report WEB 2024-2025Request
- kAIron Penetration Test Report API 2024-2025Request
- Information Security Policy (AUP)Request
- Secure Development PolicyRequest
- Data Management PolicyRequest
- Asset Management PolicyRequest
- Information Security Roles and ResponsibilitiesRequest
- Third-Party Management PolicyRequest
- Cryptography PolicyRequest
- Incident Response PlanRequest
- Physical Security PolicyRequest
- Access Control PolicyRequest
- Risk Management PolicyRequest
- Business Continuity and Disaster Recovery PlanRequest
- Operations Security PolicyRequest
- GDPR Incident Response PlanRequest
- Pseudonymization PolicyRequest
- Hybrid Workplace PolicyRequest
- Human Resource Security PolicyRequest
Subprocessors
14- AAmazon Web Services · Cloud Service ProviderUnited States, European Union (SwiftKanban)
- CCloudflare, Inc. · Content-based firewall, Zero Trust Network ProviderUnited States
- MMongoDB Atlas · Data storage and processing
- VVeracode · Security
- MMicrosoft Corporation · Microsoft Teams, Microsoft ClarityUnited States
- GGoogle LLC · Google Workspace, Google AnalyticsUnited States
- MMixpanel · Usage AnalyticsUnited States, European Union
- SStripe · Payment ManagementUnited States, India
- ZZapier · Integration PlatformUnited States
- SSnaplogic · Data and Application Integration
- OOpenAI ChatGPT · Collaboration AI ServiceUnited States
- GGitHub · Version control
Show all 14 subprocessorsShow fewer
- GGitLab · Version control
- VVanta
Compliance leadership
The person who leads NimbleWork Inc's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. NimbleWork Inc's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DescriptionAdd a one-line description so buyers recognize you.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is NimbleWork Inc SOC 2 compliant?
NimbleWork Inc is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is NimbleWork Inc ISO 27001 certified?
According to NimbleWork Inc's public trust center, NimbleWork Inc is ISO 27001 certified. On SOC2C this listing is Listed.
Is NimbleWork Inc GDPR compliant?
According to NimbleWork Inc's public trust center, NimbleWork Inc is GDPR compliant. On SOC2C this listing is Listed.
Is NimbleWork Inc SOC 2 Type I or Type II?
NimbleWork Inc is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use NimbleWork Inc's SOC 2 for a vendor risk assessment?
Yes. NimbleWork Inc's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is NimbleWork Inc penetration tested?
NimbleWork Inc hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get NimbleWork Inc's SOC 2 report?
NimbleWork Inc's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Does NimbleWork Inc have an ISO 27001 certificate?
NimbleWork Inc publishes an ISO certificate on its trust center; you can request access through SOC2C.
Is NimbleWork Inc secure?
Security isn't a single yes/no, but NimbleWork Inc is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does NimbleWork Inc have a bug bounty or vulnerability disclosure program?
NimbleWork Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@nimblework.com or via a /security page.
Who are NimbleWork Inc's subprocessors?
NimbleWork Inc lists 14 subprocessors on its trust center, including Amazon Web Services, Cloudflare, Inc., MongoDB Atlas, Veracode, Microsoft Corporation. Buyers use this for fourth-party risk review.
Where does NimbleWork Inc host or store data?
NimbleWork Inc hosts on AWS. Data residency details are on its trust center.
Where is NimbleWork Inc's trust center or security page?
NimbleWork Inc's trust center is at https://trust.nimblework.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Do the organisation and all subcontractors commissioned to provide the service (e.g., cloud IaaS or PaaS providers) have documented information security processes?
All NimbleWork products and all subcontractors have well-documented information security processes. We prioritise the establishment of robust security practices.
Does the organisation hold a valid certification (ISO 27001:2013 or ISO 27001:2022) of its Information Security Management System?
All NimbleWork products hold valid certification for their ISMS based on ISO 27001:2022. This certification underscores our commitment to information security.
Do all subcontractors hold valid certifications (ISO 27001:2013 or ISO 27001:2022)? Does the scope of the certifications cover the services utilised for the organisation?
All subcontractors engaged by all NimbleWork products must hold valid certifications, either ISO 27001 or SOC 2. The scope of these certifications covers the services utilised for the cloud service to ensure comprehensive security coverage.
At which location(s) do all NimbleWork products store, process and back up the data?
Customer data is hosted within Amazon Web Services (AWS) infrastructure in accordance with our data residency requirements. The primary data centre is located in the US East 1 region, with a secondary backup facility in the US West 2 region. All data storage and processing operations comply with applicable data protection regulations and contractual obligations. Geographic redundancy ensures business continuity while maintaining data sovereignty requirements.
Does all NimbleWork products encrypt data at rest using state-of-the-art encryption?
Yes, all customer data stored in our system is encrypted at rest using industry-standard AES-256 encryption. This encryption is applied at the database and storage levels to protect data from unauthorized access. Encryption keys are managed securely using dedicated key management services with strict access controls and regular rotation policies to maintain the highest level of data security.
Does all NimbleWork products encrypt data at rest using state-of-the-art encryption for data backups?
We apply the same encryption methodology used for data at rest to data backups, involving encrypting backup files with the same high-level encryption standards and maintaining security throughout the data lifecycle, including backup storage.
Do all NimbleWork subcontractors commissioned to provide the service (e.g., cloud IaaS or PaaS providers) encrypt data at rest using state-of-the-art encryption?
Subcontractors must implement the same state-of-the-art encryption standards for data at rest. We ensure a uniform and secure approach to data protection across the entire service infrastructure, including subcontracted components.
Does the System transmit customer data to another system not owned or managed by your organisation?
Customer data is maintained exclusively within our controlled infrastructure and is not transmitted to external systems outside our organisational boundary. All data processing and storage operations occur within our secure, internally managed environment. This architecture ensures complete data sovereignty and eliminates third-party data exposure risks. Network segmentation and access controls enforce strict boundaries to prevent unauthorised data egress.
If customer data is not stored on dedicated servers, how is Customer data logically partitioned?
Customer data is logically partitioned using a multi-tenant architecture with strict isolation controls. Each customer account is assigned a unique identifier, and all data records are tagged with this identifier to ensure complete segregation at the database level. Access control policies enforce that users can only access data associated with their authorised customer accounts. Data partitioning is implemented through database schema, row-level security policies, and application-layer access controls. This architecture prevents cross-customer data exposure and ensures compliance with data privacy requirements. Regular audits verify the integrity of partition boundaries.
Does the System encrypt data in transit?
Yes, all data transmitted by our system is encrypted in transit using industry-standard encryption protocols. We enforce the use of TLS 1.2 and 1.3 for all network communications to protect data from interception, eavesdropping, and man-in-the-middle attacks. Strong cipher suites are configured, and we regularly review and update our encryption standards to maintain compliance with current security best practices and regulatory requirements.
How are encryption keys managed and protected?
Encryption keys are managed using the cloud provider’s Key Management System (KMS), following industry best practices for security and compliance.
Do you manage encryption keys internally or rely on third parties?
We use the underlying cloud provider’s KMS, ensuring keys are stored, rotated, and protected in compliance with global security standards.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public