Question 1

Can another account read my client data?

Accepted Answer

Not by design. Records are scoped to your organization in application code, and that scoping is covered by automated tests. No software is free of defects. A coding error could expose data across organizations, which is why we test for it and why you should keep sensitive client details to what you need.

Question 2

How is my data encrypted?

Accepted Answer

Documents in the vault are encrypted at rest with AES-256-GCM before storage, and data is protected in transit by TLS. The vault key is held in our runtime environment, not in the database. Other records are stored in the application database and protected by access controls. Message attachments, voice memo audio and the contents of quote and illustration share links are not encrypted at the application layer. Share links expire after 7 days. The full statement lives at /legal/disclosures.

Question 3

Is there a record of who accessed my data?

Accepted Answer

An audit log records selected security-relevant actions, so there is a trail of who did what and when. Not every read is logged. The log is organization-scoped like the records it describes. How the data is handled is set out at /legal/terms.

Question 4

Does Nest sell or aggregate my client data?

Accepted Answer

No. Nest is software, not a data broker. It does not sell client information and does not aggregate data across organizations. Integrations are connectors, not re-sellers. You connect your own accounts, Salesforce today and more as they launch, and those accounts stay yours.

Question 5

What happens to my data if I cancel?

Accepted Answer

Contacts, leads, and policies export to CSV from Settings while your subscription is active and for a limited period after it ends. After that period we may delete your data, so export before you cancel. Your connected accounts and contracts stay with you. The handling of your data after you leave is set out in the Terms of Service.

Question 6

Is Nest HIPAA or SOC 2 compliant?

Accepted Answer

No. Nest does not currently hold SOC 2 or HIPAA attestations and does not sign business associate agreements. Do not upload nonpublic personal health information unless you have obtained any authorization required by law.

Question 7

Where are the formal security and data terms?

Accepted Answer

The formal statements live at /legal/terms and /legal/disclosures. Every claim on this page is defined there.

Vault documents encrypted at rest. Audit trail on selected actions.

Five statements, each with its definition.

The surfaces these statements cover.

Questions, answered straight.

One platform. Your tools. Your data.