Trust Center

Welcome to the Nimblemind Trust Center. This portal provides customers, partners, and visitors with an overview of Nimblemind’s security and data-protection practices for the NimbleLABS service.

NimbleLABS processes healthcare-related datasets that may include protected health information (PHI) and personally identifiable information (PII). We apply documented security, privacy, access-control, and data-protection practices appropriate to the information we handle.

Security and data protection

Nimblemind maintains an information-security program supported by documented policies and operational practices. Key measures include role-based, least-privilege access; multi-factor authentication for employees on supported systems; encryption in transit and at rest for supported production services; vulnerability-management and secure-development processes; cloud monitoring and threat-detection capabilities; and incident-response procedures.

Our public-facing application endpoints are protected with enforced web-application firewall controls, including protections against selected SQL-injection and cross-site-scripting patterns, CORS enforcement, and rate limiting.

Independent assurance

Nimblemind has completed a SOC 2 Type II examination covering the security controls for the NimbleLABS System. We also conduct external web-application penetration testing and use the results to support our vulnerability-management program.

Privacy and third parties

Nimblemind maintains a Privacy Policy and uses documented vendor-management practices for service providers. Where applicable, services processing sensitive healthcare information are subject to appropriate contractual and privacy safeguards.