Nimt is built for businesses that trust us with their data. This page describes how we protect it. For more detail, such as for a security review, email security@nimt.ai and we'll send our security overview.
Hosting
Our databases and file storage run on Amazon Web Services in the EU. Providers that process data elsewhere, such as AI model providers, are listed on our list of sub-processors, and those transfers are protected by the EU standard contractual clauses or the EU-US Data Privacy Framework.
Protecting data
- Data is encrypted in transit and at rest.
- All traffic to the service passes through a web application firewall.
- Databases and servers don't accept connections from the internet.
Access
- You sign in with a one-time email code, or with Google or Microsoft, in which case your organisation's own sign-in rules, such as MFA, apply.
- Workspace roles and project permissions control what each member can see and do, and the server checks them on every request.
- API and MCP access can be limited to read-only, and you can revoke connected apps and tokens at any time.
- Only the people at Nimt who need access to production systems have it, with individual accounts. Access to production systems is logged.
Monitoring
We record activity in our cloud accounts, run automated threat detection and continuously check our setup against AWS's security best practices.
AI and your data
Apart from the public AI services we query to track your brand, the AI providers we use may not train their models on your content. How we use AI with your data is described in our privacy policy.
Your data, your choice
You can ask us to return or delete your data. Our Data Processing Agreement describes how we process personal data on your behalf.
Reporting a security issue
If you've found a vulnerability, see Reporting security issues.