How we protect data: on the device whenever possible

The safest data is the data that never leaves the place it belongs. It’s the first rule we follow when we design a product, and it says a lot about how we work.

On the device, whenever possible. If a product can work without sending data to a server, we build it that way. RapPay keeps the day’s takings on the phone. Nimbune Core keeps projects and decisions on the Mac, in an encrypted database, and works offline too. Less data in transit means fewer chances for it to end up where it shouldn’t.

No tracking on the site. This site has no advertising, profiling or analytics cookies. The light or dark theme and the choice to reduce motion stay in your browser. The forms save only what you send us, in our own database on the Cloudflare network that serves the site, and they are protected from spam without following you from one visit to the next.

Data stays with its owners. Customers’ and users’ data stays theirs. In the Enterprise Program the software is always licensed, but accounts, domains and data stay the company’s, from day one.

Keys in a vault. Passwords and keys live in an encrypted vault, separate for every customer. Never in code, documents or chats. In Nimbune Core they stay in the system keychain, and the app only remembers where they are.

Least access. When we work on a customer’s accounts, we enter with only the permissions we need, and nothing more.

Kept out of memory. At Nimbune, what we learn from every project stays in Nimbune Core. Keys, passwords and users’ personal data never enter it: we write down the lesson, never the secret.

Review before release. Code goes through a cross review before it reaches users, and the sites run on the Cloudflare network, always over HTTPS.

Your rights, in plain words. The privacy notice explains what we collect, why and for how long. For people in the European Union we have a representative under the GDPR, and privacy requests reach us at [email protected].

No list makes a product secure on its own. But these rules, applied every day, make mistakes rarer and easier to find. If you find a vulnerability in a Nimbune product, write to [email protected] with the subject “Security”: we’ll fix it, and we ask you not to make it public until we have.