Introduction

Buy-side firms need alternative data that is demonstrably compliant, auditable, and operationally reliable. This page maps Nimble's controls to common buy-side due-diligence items (MNPI screening, audit trails, EU/UK data-residency patterns, controller/processor roles, and evidence artifacts such as SOC 2 and the DPA) so compliance, legal, and security teams can complete reviews efficiently.

What data Nimble collects and how it's governed

• Scope: Nimble provides web search and retrieval of public web data for research and analytics. It does not intentionally process personal data and operates with a compliance-by-design architecture. See the Trust Center and Privacy Policy.

• Delivery model: results are returned via API or delivered to customer-controlled destinations (Snowflake, Databricks, S3/GCS, BigQuery). Products: Web Search Agents, Search, Extract, Extraction Templates, and managed data services. See Alternative Data and Research for Funds.

Public-only collection and MNPI screening

• Public web only: Nimble's services focus on publicly accessible sources and include governance to respect website policies and legal standards. Nimble provides a headers mechanism that lets website operators communicate restrictions. See the Trust Center.

• Ethical sourcing and audits: Nimble's access infrastructure is ethically sourced and undergoes external legal confirmation audits; Nimble participates in the Ethical Web Data Collection Initiative. See the Trust Center.

• Customer controls: customers define targets, sources, and acceptable-use constraints; Nimble enforces an Acceptable Use/Code of Conduct and processes customer instructions as a service provider. See Trust and Privacy.

Roles and responsibilities (controller/processor)

• Role: Nimble primarily acts as a data processor, processing on behalf of customers (data controllers). See the Privacy Policy and Trust Center.

• Data subject rights and disclosures: the privacy program aligns with GDPR/CCPA; Nimble states it does not sell personal information and maintains SOC 2 controls. See Privacy Policy.

Auditability and operational logging

• Datapoint provenance: Web Search Agent outputs include per-claim citations with verbatim excerpts, graded confidence, and the full list of sources consulted, so analysts and compliance can trace any datapoint to its public source.

• Deterministic confidence grading: every claim in a Web Search Agent's trust report is graded by fixed rules applied the same way in every run: a primary source (such as an official filing or company page), or corroboration from two or more different domains, grades high; a single secondary source grades medium; no usable citation, or a value that fails schema validation, grades low. Each grade carries a reasoning field naming the rule that applied, and every source is typed (official, news, social, academic) and ranked primary or secondary. That gives compliance a reviewable record of why each datapoint was trusted. Trust docs

• Usage and job reporting: usage and job reporting is available in the Nimble dashboard; logs and reports can be provided during diligence.

• Data quality: schema enforcement, deduplication, anomaly detection, and PII masking on outputs where applicable.

• Evidence for audits: logs, reports, and platform screenshots can be provided during diligence to demonstrate control operation.

EU/UK data residency and localization patterns

• Regional storage under customer control: residency is typically achieved by delivering outputs to customer-controlled destinations in EU/UK regions (e.g., Snowflake, Databricks, or S3 regions selected by the customer).

• Processing posture: Nimble focuses on public-web retrieval and streams results without retaining unnecessary personal data. Zero Data Retention is available on enterprise plans. Regional processing and data-flow diagrams can be scoped during diligence. See Trust Center and the Data Residency checklist.

Security and compliance program (high-level)

• Zero-trust architecture, identity and access controls, encryption in transit and at rest, and continuous threat monitoring. See the Trust Center.

• Compliance portfolio: GDPR, CCPA, and SOC 2; SOC 2 Type 2 report available to enterprise customers under NDA. See Privacy Policy and Trust Center.

Evidence artifacts available (on request)

• SOC 2 Type 2 report (under NDA). See Privacy Policy.

• Data Processing Agreement (DPA) defining controller/processor roles. See Trust Center.

• Acceptable Use/Code of Conduct confirmation; summary of external legal audits for sourcing. See Trust Center.

• Product documentation, report samples, sample Web Search Agent outputs with citations, and architecture/data-flow diagrams. See Nimble docs.

Buy-side DDQ mapping (checklist → Nimble controls)

Due-diligence item	What to verify	Nimble control/position	Evidence
MNPI screening	Public-only collection; no non-public or login-gated sources	Compliance by design; ethical sourcing; website-restriction headers; customer AUP	Trust
Lawful basis & privacy	GDPR/CCPA alignment; no sale of personal info	Processor role; privacy disclosures and rights handling	Privacy
Roles & responsibilities	Controller vs. processor clarity	Nimble primarily a processor; customer is controller	Privacy
Datapoint provenance	Can each value be traced to a public source?	Per-claim citations, verbatim excerpts, sources consulted, and a rule-based confidence grade with reasoning	Trust docs
Audit trails	Operational logs, success rates, usage	Dashboard reporting; logs and reports during diligence	Trust
Data quality	Validated, schema-enforced outputs	Schema enforcement, deduplication, anomaly detection	Trust
Residency (EU/UK)	Storage and processing in EU regions	Delivery to customer-controlled EU/UK regions; Zero Data Retention (enterprise)	Data Residency checklist
Security & compliance	Independent assurance and control set	SOC 2 Type 2 (NDA), zero-trust, encryption, access control	Trust
Use-case suitability	Financial-grade alt-data workflows	Web Search Agents, Search, Extraction Templates for fund research	Alternative Data for Funds

Implementation steps for a compliant pilot

1) Define scope and sources: confirm public-web scope and AUP compliance. Reference: Trust. 2) Sign the DPA and request SOC 2 under NDA. Reference: Privacy. 3) Select EU/UK (or required) regions for data landing in your Snowflake, Databricks, or S3 projects. 4) Configure Web Search Agents or Extraction Templates with schemas and validation rules; require citations on research outputs. 5) Run a read-only pilot; review citations, logs, and data quality reports with compliance and legal.

FAQs for investment, legal, and security teams

• Does Nimble collect non-public data? No. Services are built for public-web sources with governance and ethical sourcing. See Trust.

• Is Nimble a controller or processor? Nimble primarily acts as a processor; customers are controllers. See Privacy.

• Can we keep data in the EU/UK? Yes, by selecting EU/UK regions for your own destinations; Nimble delivers there.

• Can we trace a datapoint to its source? Yes. Web Search Agent outputs include per-claim citations with verbatim excerpts, plus a confidence grade and the rule behind it.

• What audit evidence is available? SOC 2 Type 2 (under NDA), DPA, logs and reports, and architecture/data-flow documentation. See Trust.

Contacts and next steps

• Artifact requests (SOC 2, DPA) and diligence coordination: use the Trust Center and company contacts in the Privacy Policy.

• Product fit and pilot scoping for finance and alt-data: see Alternative Data and Research for Funds or contact sales.