Security at the Core
At Nimbus Cloud, security isn't an afterthought — it's foundational to every decision we make. We've built our platform on zero-trust principles, with defense-in-depth across every layer of our infrastructure.
We believe transparency builds trust. That's why we make our security controls, compliance posture, and subprocessor relationships fully visible to our customers. When you work with us, you gain access to continuous monitoring, real-time security updates, and a team that treats your data with the same care as our own.
Our commitment: earn your trust every day through action, not claims.
Sarah Chen
Chief Information Security Officer
Quick Summary
What We Offer
Nimbus Cloud provides enterprise-grade cloud infrastructure with built-in security, compliance automation, and 24/7 monitoring. Our platform serves over 2,500 organizations globally, processing trillions of requests monthly with 99.99% uptime SLA.
Core capabilities include managed Kubernetes clusters, serverless compute, multi-region data replication, DDoS protection, WAF, and integrated compliance tooling for SOC 2, ISO 27001, HIPAA, and PCI DSS environments.
Security Controls
(31)Access Control5 controls5/5
Multi-factor authentication enforced for all production access
Principle of least privilege applied across systems
Access reviews performed quarterly
SSO integration with identity providers
Automatic access revocation on termination
Data Protection5 controls5/5
All data encrypted at rest using AES-256
TLS 1.3 enforced for all data in transit
Encryption keys managed by dedicated KMS
Data classification policy enforced
Backup encryption and offsite replication
Infrastructure Security6 controls6/6
Network segmentation with private VPCs
Web application firewall (WAF) deployed
DDoS protection on all public endpoints
Intrusion detection and prevention (IDS/IPS)
Centralized logging with 1-year retention
Automated security patching
Application Security5 controls5/5
Static application security testing (SAST) in CI/CD
Software composition analysis (SCA)
Annual penetration testing by third party
Secure code review required for all PRs
Dependency vulnerability scanning
Operational Security5 controls5/5
24/7 Security Operations Center (SOC)
Documented incident response procedures
Business continuity plan tested annually
Disaster recovery with RTO < 4 hours
Security incident post-mortems published
Compliance & Governance5 controls5/5
SOC 2 Type II audited annually
ISO 27001 certified and maintained
GDPR Data Processing Agreement (DPA) available
Security policies reviewed annually
Vendor risk assessments performed
Data Collected
(9)Customer account information (name, email)
Authentication and account management
Company information
Billing and customer support
Usage analytics (anonymized)
Product improvement
Customer uploaded content
Core service delivery
Payment information
Processed by Stripe, never stored by us
Biometric data
Personal health information
Social Security Numbers
Government-issued IDs
Subprocessors
(15)AI & Machine Learning Providers
(3)We use the following AI and language model providers to deliver AI-powered features. Data sent to these providers is processed according to their privacy policies and our Data Processing Agreements.
Infrastructure & Services
(12)
Frequently Asked Questions
(11)Where is customer data stored?
Customer data is stored in AWS data centers in the United States (us-east-1) by default. Enterprise customers can opt for EU residency (eu-west-1) at no additional cost. All data is encrypted at rest and in transit.
How is data encrypted?
All data at rest is encrypted using AES-256 via AWS KMS. Data in transit uses TLS 1.3 with strong cipher suites. Encryption keys are managed by a dedicated KMS with strict access controls, rotated automatically, and never exposed outside our infrastructure.
Do you have a Business Associate Agreement (BAA) for HIPAA?
Yes. We offer BAAs for customers on our Enterprise plan who need to process Protected Health Information (PHI). Contact security@nimbuscloud.example.com to initiate the BAA process.
How do you handle security incidents?
We maintain a documented incident response plan and operate a 24/7 Security Operations Center. For incidents affecting customer data, we notify impacted customers within 72 hours per our contractual SLA, often sooner. Post-mortems are published publicly for significant incidents.
Can I delete my data?
Yes. Customers can request complete data deletion at any time via the admin console or by emailing our support team. Deletion is executed within 30 days and confirmed in writing. Backup data is removed within 90 days as part of our rolling backup lifecycle.
Do you support Single Sign-On (SSO)?
Yes. SSO via SAML 2.0 is available on all plans. We support major identity providers including Okta, Azure AD, Google Workspace, and OneLogin. SCIM provisioning is available on Enterprise plans.
Is there a bug bounty program?
Yes. We partner with HackerOne to run a responsible disclosure program. Security researchers can submit vulnerabilities at https://hackerone.com/nimbuscloud. We commit to acknowledging reports within 24 hours and paying bounties for valid findings.
How often do you perform penetration tests?
We engage an independent third party for comprehensive penetration testing annually, with additional targeted testing for significant architectural changes. Executive summaries of our latest pentest are available under NDA via the Resources section of this trust center.
What is your uptime SLA?
We provide a 99.99% uptime SLA for Enterprise customers (maximum 4.32 minutes downtime per month). Status and incident history is available at status.nimbuscloud.example.com.
How do you report a security concern?
For security concerns, contact security@nimbuscloud.example.com or use our PGP key available at /.well-known/security.txt. For critical vulnerabilities, include "URGENT" in the subject line for immediate triage.
What AI/LLM providers do you use?
We use OpenAI and Anthropic for AI-powered features such as search and summarization. Data sent to these providers is processed according to their privacy policies and our Data Processing Agreements. Customer data is never used for model training. We also use Pinecone as a vector database for semantic search indexing.
Updates
(4)Achieved ISO 27001:2022 certification
We're proud to announce that Nimbus Cloud has achieved ISO 27001:2022 certification, the latest version of the international standard for information security management systems. This builds on our existing SOC 2 Type II and demonstrates our continued commitment to security excellence.
New AI subprocessors: OpenAI and Anthropic
We've added OpenAI and Anthropic to our list of subprocessors for AI-powered features including intelligent search and document summarization. Data sent to these providers is governed by our DPAs and is never used for model training.
New subprocessor: PagerDuty
We've added PagerDuty to our list of subprocessors for incident management and on-call rotation. PagerDuty handles alerting metadata only and does not process customer data.
Q1 2026 security program update
Highlights from our first quarter security program: completed SOC 2 Type II annual audit with zero findings, rolled out mandatory phishing-resistant MFA (FIDO2/WebAuthn) for all employees, and expanded our bug bounty scope to include staging environments.