Nudge Security, Inc.

United States

Customer data is retained for as long as the account is in active status. Data enters an “expired” state when the account is voluntarily closed. Expired account data will be retained for 30 days. After this period, the account and related data will be removed. Customers that wish to voluntarily close their account should download their data manually or via the API prior to closing their account. If a customer account is involuntarily suspended, then there is a 30 days grace period during which the account will be inaccessible but can be reopened if the customer meets their payment obligations and resolves any terms of service violations. If a customer wishes to manually backup their data in a suspended account, then they must ensure that their account is brought back to good standing so that the user interface will be available for their use. After 7 days, the suspended account will be closed and the data will enter the “expired” state. It will be permanently removed 30 days thereafter (except when required by law to retain).

Customer data is retained for as long as the account is in active status. Data enters an “expired” state when the account is voluntarily closed. Expired account data will be retained for 30 days. After this period, the account and related data will be removed. Customers that wish to voluntarily close their account should download their data manually or via the API prior to closing their account. If a customer account is involuntarily suspended, then there is a 30 days grace period during which the account will be inaccessible but can be reopened if the customer meets their payment obligations and resolves any terms of service violations. If a customer wishes to manually backup their data in a suspended account, then they must ensure that their account is brought back to good standing so that the user interface will be available for their use. After 7 days, the suspended account will be closed and the data will enter the “expired” state. It will be permanently removed 30 days thereafter (except when required by law to retain).

Nudge Security hosts on Amazon Web Services (AWS) in the US-East-1 (N. Virginia) region by default. All Nudge Security employees adhere to the following processes to reduce the risk of compromising Production Data: • Implement and/or review controls designed to protect Production Data from improper alteration or destruction. • Ensure that confidential data is stored in a manner that supports user access logs and automated monitoring for potential security incidents. • Ensure Nudge Security Customer Production Data is segmented and only accessible to Customer authorized to access data. • All Production Data at rest is stored on encrypted volumes using encryption keys managed by Nudge Security. • Volume encryption keys and machines that generate volume encryption keys are protected from unauthorized access. Volume encryption key material is protected with access controls such that the key material is only accessible by privileged accounts. Nudge Security employee access to production is guarded by an approval process and by default is disabled. When access is approved, temporary access is granted that allows access to production. Production access is reviewed by the security team on a case by case basis. Customer data is logically separated at the database/datastore level using a unique identifier for the customer. The separation is enforced at the API layer where the client must authenticate with a chosen account and then the customer unique identifier is included in the access token and used by the API to restrict access to data to the account. All database/datastore queries then include the account identifier.

United States

Cloud hosted

Amazon AWS

no

no

We allow in-product requests to delete all data from an organization once a trial has started or a customer is deployed.

no

2024-07-11

yes

Google Workspaces, Office 365, Okta

no

yes

no

no

yes

AWS, Teleport, Google Cloud, Atlassian, Segment, Auth0, Datadog..

yes