.webp)
.png)
.webp)
Your AI searches the web safely with Nimble
Learn how Nimble keeps your AI’s web access reliable, secure, and ready for enterprise review.
.webp)
.webp)
.webp)
.webp)
Your agent's queries stay yours
Agents send web search tools sensitive context: deal targets, legal questions, competitive research. With Zero Data Retention (ZDR), Nimble processes each request and keeps none of it. Your queries, your search context, and the outputs we return are kept out of our logs and storage.
We don't store what your agent searched for.
We don't keep the search context or the reasoning Nimble runs on your behalf.
We don't keep the results, answers, or extracted data we return to you.
Built to meet the frameworks your reviewers check
Nimble's controls are mapped to the frameworks enterprise security and privacy teams ask about first.
Annual independent audit of our security, availability, and data handling controls.
Documented technical and organizational measures, with a DPA available for every customer.
We comply with the CCPA and other leading US data protection laws, and track new legislation as it passes.
Independently audited, every year
Every year, an independent auditor tests how our security, access, change management, and data handling controls work in practice over an extended observation period, not just how they look on paper.
SOC 2 Type II report or letter of attestation (under NDA)
Third-party penetration test letter of attestation
GDPR technical and organizational measures overview
Data Processing Agreement (DPA)
Mutual NDA
Security built into the platform
Encryption
Data is encrypted in transit – your data is never at rest in our platform.
No training on your data
We never use customer queries, context, or outputs to train models. Every AI provider in our stack is a commercially licensed enterprise service running under zero data retention. We don't use free or public AI services.
Access control
Role-based access control, least-privilege access to production, and regular access reviews.
Monitoring and audit trails
Centralized logging, continuous threat monitoring, and audit trails across our infrastructure.
Secure development
Every code change is reviewed and scanned for vulnerabilities before it ships.
Vendor management
Every subprocessor goes through a risk assessment, and critical vendors are reviewed regularly.
Web content your agents can trust
The open web is untrusted input. Pages can hide instructions meant to hijack an AI agent. Nimble scans captured web content for prompt injection and other malicious payloads before it reaches your agent, so your agents work from what a page actually says, not from instructions an attacker planted in it.
.webp)
Govern how your agents use the web
Domain controls
Include or exclude domains at the organization or API key level.
Safe search
Filter adult and violent content out of results.
Usage monitoring
Track usage by API key so you can see which agents and teams are calling Nimble.
Dedicated deployments
Dedicated deployment and tenant configuration are available for teams with data residency requirements.
.png){kind=logo}
.webp)
How we hold ourselves accountable
Data Protection
Our privacy policy explains how Nimble processes personal data and the rights available to you.
Acceptable Use
Customers must use Nimble in good faith, follow applicable laws, and comply with our Acceptable Use Policy.
Code of Conduct
Every Nimble employee completes security and compliance training and commits to our standards for integrity and responsible conduct.
Offensive security testing — detail
We test our platform the way an attacker would, on a routine schedule.
Independent penetration testing. A third-party firm runs penetration tests against our platform and infrastructure on a regular cycle. The attestation letter is available on request.
Continuous vulnerability scanning. Every pull request is scanned before it can merge, and full scans of our codebase and infrastructure run every week.
Tracked remediation. Findings are filed automatically, routed to the owning team, and fixed against defined severity timelines.
.webp)
.webp)
Bring Nimble through your security review
Trust Center FAQs
Not for Enterprise customers with Zero Data Retention turned on. Queries, search context, and outputs are kept out of our logs and storage. Accounts without ZDR follow our standard data retention policy.
Not for Enterprise customers with Zero Data Retention turned on. Queries, search context, and outputs are kept out of our logs and storage. Accounts without ZDR follow our standard data retention policy.
No. We don't use customer queries, context, or outputs to train models, and the enterprise AI providers we use don't train on our inputs either.
Yes. Nimble holds a SOC 2 Type II certification and is audited every year by an independent firm. The report is available under NDA.
For customer data, Nimble acts mainly as a data processor that handles data on behalf of our customers, who are the data controllers.
Yes. We offer a binding DPA covering privacy, confidentiality, and security measures.
Yes. Nimble complies with GDPR and leading US data protection laws, including the CCPA, and we track new legislation as it passes.
Customer data is deleted within 90 days of the end of your contract, as set out in our Data Retention Policy.
Contact our team and we'll share our SOC 2 report, pen test attestation, DPA, and GDPR documentation, and work through your security questionnaire.