Trust Center

How Nimble protects your information, how we respond when security issues arise, and how to reach our security team.

Security Credentials

Independent audits and government authorizations behind our services.

Protected B cleared facilities

Our facilities in Aurora, Ottawa and Winnipeg have been audited by government agencies and cleared to process Protected B information.

Federal SA&A — Authority to Operate

Nimble's facilities and SmartCloud software have completed the Government of Canada Security Assessment and Authorization (SA&A) process and hold Authority to Operate (ATO).

SOC 2 Type II

Our security controls are independently audited. The report is available to customers and prospects under NDA.

ITSP.10.033 (ITSG-33)

Controls implemented against the Government of Canada's IT security risk management framework.

Canadian privacy law

Compliant with PIPEDA, PHIPA and FIPPA.

100% Canadian-owned

No foreign parent and no US CLOUD Act exposure. Data and processing stay in Canada.

How We Protect Your Data

24/7 security monitoring

Internet-facing systems are monitored around the clock by our security information and event management (SIEM) platform, with alerts routed to IT management at any hour.

Availability monitoring

Customer environments are monitored around the clock by independent third-party monitoring, and each customer receives a private status page for their environment.

Vulnerability management

Weekly vulnerability scanning of our hosting environment, with critical issues patched promptly.

Secure development

Client-facing web applications go through code-hardening reviews and automated application security testing before release.

Encryption

Client data is encrypted in transit (TLS) and at rest on the storage systems that hold it.

Physical chain of custody

RFID-tracked document handling with timestamped logs, exception reporting and certificates of destruction.

Access control and people

Role-based access, end-to-end audit trails, and security-cleared Canadian staff.

Incident response

If a security incident affects your information, we notify you directly and meet our breach-reporting obligations under Canadian privacy law.

Security Advisories

When a widely reported vulnerability could reasonably concern our customers, we publish whether Nimble's products and services are affected and what we have done about it. Each advisory is updated as the situation changes.

Published October 20, 2026Updated October 21, 2026
PHP remote code execution vulnerabilities (php2shell, CVE-2026-109618 and CVE-2026-109619)
Status: Not affected. Nimble's customer-facing products and services do not run PHP. One internal business system that uses PHP has been updated to a patched release.
Read advisory

Vulnerability Disclosure

Found a security issue in a Nimble website, product or service? We want to hear about it.

How to report

Email security@nimble.ca with a description of the issue, the affected URL or product, steps to reproduce it, and any proof of concept.

What we commit to

Acknowledge your report within three business days.
Keep you informed while we investigate and fix the issue.
Credit you once it is fixed, if you wish.

Guidelines

Test only against accounts and data you own.
Do not access, modify or delete data that belongs to others.
No denial-of-service, spam, social engineering or physical testing.
Give us reasonable time to fix the issue before any public disclosure.

We will not pursue legal action against anyone who reports an issue in good faith and follows these guidelines. We do not currently run a paid bug bounty program.