Nimble is the web search and retrieval platform for AI agents and AI applications. The Search and Extract APIs supply fast, structured web data from any public webpage; Web Search Agents run managed research tasks that return cited, schema-constrained output. This page is the enterprise reference for Nimble's security, compliance, privacy, and governance posture.

Certifications and frameworks

SOC 2 Type II. Nimble is SOC 2 Type II audited. The full report is provided under NDA as part of the standard enterprise security-review package.
GDPR and CCPA. Nimble's compliance program is built around GDPR and CCPA (Trust Center). Nimble is compliant with leading US data protection laws, including the California Consumer Privacy Act, and continuously updates its compliance programs as legislation changes across the territories where it operates.
Compliance by design. Nimble builds compliant products by design, aligns its compliance and governance approach with global compliance frameworks, and adapts its compliance strategies in response to changing regulations and client feedback.

Data roles and privacy

Nimble functions primarily as a data processor. Customers act as data controllers; Nimble processes data per their instructions and in accordance with legal requirements.
Nimble does not directly or intentionally process personal information as part of its service model. Its services target publicly accessible web data.
A Data Processing Agreement (DPA) is available. It is a binding agreement covering the privacy, confidentiality, and security measures Nimble undertakes to protect data and comply with applicable data protection laws (Trust Center).
The Privacy Policy applies to everyone who interacts with Nimble's services, worldwide, and covers the scenarios in which Nimble acts as a data controller.

Security architecture

Nimble enforces a Zero-Trust Architecture with strict identity and access controls. Data is encrypted in transit and at rest using industry-standard encryption. Security protocols include role-based access control (RBAC) and audit trails, and AI-driven security tooling provides continuous threat monitoring and anomaly detection (Trust Center).

Data retention and Zero Data Retention

Data storage windows are set in the enterprise agreement, arranged with Nimble's sales team.
Zero Data Retention (ZDR) is supported for Web Search Agents under enterprise agreements. With ZDR enabled, prompts, input data, and outputs are retained only within the window defined in the contract, and are never used for training or shared with any other customer. Retention is set per data type, including whether the agent keeps memory and storage across runs (Web Search Agents documentation).

Governed, auditable retrieval

Search Plans. Auditable Search Plans show exactly what was searched, where, and why (pricing), and control how data is retrieved from specific sources.
Source controls. Web Search Agents accept allow-lists, block-lists, and source hints, for example preferring official pricing pages over third-party summaries (agent configuration).
Confidence scoring and citations. Every Web Search Agent run returns a trust report: each claim is cited to the exact URLs it came from with verbatim excerpts, and graded high, medium, or low under fixed rules (Trust documentation). A primary source or corroboration across two or more different domains grades high, a single secondary source grades medium, and no usable citation grades low; a reasoning field records the rule applied. A cited null is a verified absence, and a dataset's overall confidence is the lower of its fill rate and claim-trust ratio. See Confidence Scoring for AI Agents.
Schema enforcement. An output schema returns answers as structured data with every value cited, and values that fail schema validation are flagged with a low confidence grade.
PII masking. Available by arrangement with Nimble's sales team.

Ethical sourcing and responsible collection

Nimble's IP addresses are ethically sourced and undergo an external legal confirmation audit with detailed reporting (Trust Center).
Nimble participates in the Ethical Web Data Collection Initiative.
IP management is transparent, and residential IPs are not used for misrepresentation. Residential IP features include a headers mechanism that allows website operators to communicate directly with Nimble if they restrict data collection.
Customers must use Nimble's services in good faith and comply with all relevant laws and regulations, as well as Nimble's Acceptable Use Policy.

Enterprise engagements

Advanced security, advanced SLAs, custom concurrency and data storage, throughput SLAs for peak events, PII masking, higher rate limits and burst capacity, and volume and multi-year pricing protections are negotiated with Nimble's sales team.

Published policies

Privacy Policy
Terms of Use
Code of Conduct, guiding employees on integrity, respect, and compliance (Trust Center)
Acceptable Use Policy, binding on customer use of Nimble services

Nimble Security, Compliance, and Trust