// Trust & Security Report
Nutshell
AI-powered Sales CRM and marketing automation platform (contact management, pipelines, email/SMS marketing, quotes & e-sign, Nutshell AI / Nutshell IQ)
Certifications held
5
Maturity
Growth
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.nutshell.com“Opens in new tab Overview Resources Controls Subprocessors FAQ Media Compliance SOC 2 GDPR Resources View all Third-party audits & reviews 2025 SOC 2 Final Report Cloud Application Security Assessment 2025”
Verify on trust.nutshell.com“in new tab Overview Resources Controls Subprocessors FAQ Media Compliance SOC 2 GDPR Resources View all Third-party audits & reviews 2025 SOC 2 Final Report Cloud Application Security Assessment 2025 pen”
Verify on support.nutshell.com“We do not store credit card or other financial information on our servers, and billing information is always secured with a PCI-compliant provider.”
Verify on trust.nutshell.com“Third-party audits & reviews ... Cloud Application Security Assessment”
> Show 2 unconfirmed / not-held certifications
source: trust.nutshell.comNo ISO 27001 certification is referenced on Nutshell's security page or Trust Center.
source: trust.nutshell.comTrust Center lists 'Personal health information' under data-collected categories but no HIPAA certification, BAA, or attestation is published.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
United States (AWS). 'Your data is securely stored in the United States on AWS servers.' EU Model Clauses / SCCs offered via signed DPA for EU customers.
Nutshell AI (summarization, call/meeting notetakers, IQ) routes data to OpenAI and Anthropic models. Per vendor: 'OpenAI and Anthropic will not use data submitted to train or improve their models. Data sent to these models will be retained for abuse monitoring purposes for a maximum of 30 days, after which it will be deleted.' Nutshell has a signed DPA with OpenAI including EU SCCs. Nutshell itself does not claim to train on customer data.
// Security controls
Encryption at rest
Data encrypted at rest in AWS databases. 'Your data is encrypted at rest in our databases.'
nutshell.comEncryption in transit
256-bit TLS 1.2. 'We use bank-grade, 256-bit TLS 1.2 encryption every time you access your Nutshell account.'
nutshell.comPenetration testing
Yes - third-party pen test conducted. Trust Center lists '2025 pen test letter' and 'Vanta engagement letter' under third-party audits & reviews.
trust.nutshell.comBug bounty program
None. 'Nutshell does not offer a bug bounty program to pay for reports.'
nutshell.comSSO
Supported on Enterprise tier. 'Nutshell supports SSO on Google, Microsoft and SAML/SCIM in our Enterprise tier' including SAML SSO and directory sync (SCIM).
nutshell.comHosting
Amazon Web Services (AWS), US-based. Subprocessors: AWS (hosting/storage), Google Workspace, Intercom (support), WebFX (web analytics).
trust.nutshell.comTrust Center automation
Trust Center is Vanta-powered with continuous controls monitoring (infrastructure, organizational, product, data & privacy controls) and gated access to SOC 2 report, pen test letter, and CASA assessment via 'Request access'.
trust.nutshell.com// Products & data scope
Data it handles: Stores customer contacts, companies, leads, pipelines, emails (Gmail/Outlook two-way sync), calendar, calls/meetings. Customer PII and employee PII. US/AWS hosted.
Tiered pricing $13-$79 per user/month. SSO, SQL access and scheduled phone support are Enterprise-only ($79).
Data it handles: Sends call/meeting/CRM content to OpenAI and Anthropic for processing. No-training guarantee from providers; max 30-day abuse-monitoring retention then deletion. TLS in transit. DPA + SCCs with OpenAI.
Higher AI features gated to Business ($59) and Enterprise tiers.
Data it handles: Captures lead/visitor data via forms, chatbot, landing pages; sends email/SMS campaigns. WebFX handles web visitor analytics and form submission routing.
WebFX (parent company) is a listed subprocessor for marketing analytics.
Data it handles: Programmatic import/export of contacts, people, leads for data portability and GDPR delete/edit requests.
Used for GDPR data-portability and right-to-erasure workflows.
// What to watch
- AI features depend on third-party LLM subprocessors (OpenAI, Anthropic) not individually enumerated in the Trust Center subprocessor list, though covered by AI data-privacy article and OpenAI DPA.
- Trust Center lists 'Personal health information' among data categories collected, but Nutshell publishes no HIPAA attestation/BAA - buyers handling PHI should not assume HIPAA coverage.
- Data residency is US-only with no EU/regional data hosting option - relevant for EU data-localization requirements.
- SOC 2 report, pen test letter, and CASA assessment are gated behind 'Request access' on the Trust Center (standard, but not openly downloadable).
- No bug bounty program (vendor-confirmed).
// At a glance
Pricing model
Per-user SaaS subscription, 5 tiers $13-$79/user/month (annual billing saves 15%); 14-day free trial, no credit card required
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Nutshell (a WebFX company)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.nutshell.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.