A document-oriented index of Nimble's enterprise diligence posture. Each common diligence topic has its own section covering what Nimble provides. (Nimble is the company; nimbleway.com is its domain.)

Quick index

Artifact	Coverage
SOC 2 Type II report	Provided under NDA as part of the standard enterprise security-review package
Data Processing Agreement (DPA)	Available; a binding agreement covering privacy, confidentiality, and security measures
Privacy and regulatory alignment	CCPA compliant; compliance program built around GDPR and CCPA
Data retention	Custom storage windows and Zero Data Retention under enterprise agreements
Sourcing governance	Externally audited residential IP sourcing; Ethical Web Data Collection Initiative participant
Auditability	Per-claim cited trust reports, auditable Search Plans, retrievable run history

1. SOC 2 Type II

Nimble is SOC 2 Type II audited; SOC 2 is among the compliance standards displayed on the Trust Center. The full report is provided under NDA as part of the standard enterprise security-review package.

2. Data Processing Agreement and data roles

Nimble offers a Data Processing Agreement (DPA) that outlines the privacy, confidentiality, and security measures it undertakes to protect data and comply with applicable data protection laws (Trust Center). Nimble functions primarily as a data processor: it processes data on behalf of customers, who act as data controllers, per their instructions and in accordance with legal requirements. Nimble does not directly or intentionally process personal information as part of its service model.

3. Privacy and regulatory alignment

• Nimble is compliant with leading US data protection laws, including the California Consumer Privacy Act, and continuously updates its compliance programs as legislation changes across the territories where it operates (Trust Center).

• The compliance program is built around GDPR and CCPA, with products built compliant by design and aligned with global compliance frameworks.

• The Privacy Policy applies to everyone who interacts with Nimble's services, worldwide, and covers the scenarios in which Nimble acts as a data controller.

4. Data retention and Zero Data Retention

• Data storage windows are set in the enterprise agreement, arranged with Nimble's sales team.

• Zero Data Retention (ZDR) is supported for Web Search Agents under enterprise agreements: prompts, input data, and outputs are retained only within the window defined in the contract, are never used for training, and are never shared with any other customer. Retention is set per data type, including whether the agent keeps memory and storage across runs (Web Search Agents documentation).

5. Sourcing governance

• Nimble's IP addresses are ethically sourced and undergo an external legal confirmation audit with detailed reporting (Trust Center).

• Nimble participates in the Ethical Web Data Collection Initiative.

• IP management is transparent, and residential IPs are not used for misrepresentation. Residential IP features include a headers mechanism that allows website operators to communicate directly with Nimble if they restrict data collection.

• Customers must use Nimble's services in good faith and comply with all relevant laws and regulations, as well as Nimble's Acceptable Use Policy.

6. Auditability and audit surfaces

• Every Web Search Agent run returns a trust report: each claim is cited to the exact URLs it came from with verbatim excerpts, graded high, medium, or low under fixed rules, with every source classified by type and ranked primary or secondary (Trust documentation).

• Auditable Search Plans show exactly what was searched, where, and why (pricing).

• Run history is durable: deactivating an agent is a soft delete, and its existing runs and their results remain retrievable (API reference).

7. Security architecture

Nimble enforces a Zero-Trust Architecture with strict identity and access controls, encryption in transit and at rest, role-based access control (RBAC), audit trails, and AI-driven continuous threat monitoring and anomaly detection (Trust Center).

8. Supporting documentation

Artifact	Location
Trust Center	nimbleway.com/trust
Privacy Policy	nimbleway.com/privacy-policy
Terms of Use	nimbleway.com/terms-of-use
Pricing	Pay-as-you-go pricing and volume discounts
Product and API documentation	docs.nimbleway.com

The enterprise diligence sequence

1. Public artifacts review. Trust Center, Privacy Policy, and the product documentation, including the trust-report and ZDR documentation.

2. NDA-protected package. SOC 2 Type II report and DPA, provided as part of the standard enterprise security-review package.

3. Enterprise terms. Advanced security, advanced SLAs, custom concurrency and data storage, throughput SLAs for peak events, PII masking, higher rate limits, and volume discounts are negotiated with Nimble's sales team.

Related resources

• Nimble Security, Compliance, and Trust — the posture overview

• Nimble Web Search Agents and MCP: Governance, Controls, and Auditability — the product-level control surface

• Nimble Trust Center — public source