// Trust & Security Report
Nutshell (a WebFX company)
AI-powered Sales CRM and marketing automation platform (contact management, pipelines, email/SMS marketing, quotes & e-sign, Nutshell AI / Nutshell IQ)
Certifications held
6
Maturity
Growth
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.nutshell.com“Compliance: SOC 2 ... Third-party audits & reviews: 2025 SOC 2 Final Report”
Verify on support.nutshell.com“We are committed to our customers' data protection and data privacy, and we welcome the General Data Protection Regulation (GDPR) ... Nutshell is a data processor for your organization.”
Verify on support.nutshell.com“We do not store credit card or other financial information on our servers, and billing information is always secured with a PCI-compliant provider.”
Verify on trust.nutshell.com“Third-party audits & reviews ... Cloud Application Security Assessment”
Verify on trust.nutshell.com“Trust Center lists 'Personal health information' under data-collected categories but no HIPAA certification, BAA, or attestation is published.”
> Show 1 unconfirmed / not-held certifications
source: trust.nutshell.comNo ISO 27001 certification is referenced on Nutshell's security page or Trust Center.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
United States (AWS). 'Your data is securely stored in the United States on AWS servers.' EU Model Clauses / SCCs offered via signed DPA for EU customers.
Nutshell AI (summarization, call/meeting notetakers, IQ) routes data to OpenAI and Anthropic models. Per vendor: 'OpenAI and Anthropic will not use data submitted to train or improve their models. Data sent to these models will be retained for abuse monitoring purposes for a maximum of 30 days, after which it will be deleted.' Nutshell has a signed DPA with OpenAI including EU SCCs. Nutshell itself does not claim to train on customer data.
// Security controls
Encryption at rest
Data encrypted at rest in AWS databases. 'Your data is encrypted at rest in our databases.'
nutshell.comEncryption in transit
256-bit TLS 1.2. 'We use bank-grade, 256-bit TLS 1.2 encryption every time you access your Nutshell account.'
nutshell.comPenetration testing
Yes - third-party pen test conducted. Trust Center lists '2025 pen test letter' and 'Vanta engagement letter' under third-party audits & reviews.
trust.nutshell.comBug bounty program
None. 'Nutshell does not offer a bug bounty program to pay for reports.'
nutshell.comSSO
Supported on Enterprise tier. 'Nutshell supports SSO on Google, Microsoft and SAML/SCIM in our Enterprise tier' including SAML SSO and directory sync (SCIM).
nutshell.comHosting
Amazon Web Services (AWS), US-based. Subprocessors: AWS (hosting/storage), Google Workspace, Intercom (support), WebFX (web analytics).
trust.nutshell.comTrust Center automation
Trust Center is Vanta-powered with continuous controls monitoring (infrastructure, organizational, product, data & privacy controls) and gated access to SOC 2 report, pen test letter, and CASA assessment via 'Request access'.
trust.nutshell.com// Products & data scope
data: Stores customer contacts, companies, leads, pipelines, emails (Gmail/Outlook two-way sync), calendar, calls/meetings. Customer PII and employee PII. US/AWS hosted.
Tiered pricing $13-$79 per user/month. SSO, SQL access and scheduled phone support are Enterprise-only ($79).
data: Sends call/meeting/CRM content to OpenAI and Anthropic for processing. No-training guarantee from providers; max 30-day abuse-monitoring retention then deletion. TLS in transit. DPA + SCCs with OpenAI.
Higher AI features gated to Business ($59) and Enterprise tiers.
data: Captures lead/visitor data via forms, chatbot, landing pages; sends email/SMS campaigns. WebFX handles web visitor analytics and form submission routing.
WebFX (parent company) is a listed subprocessor for marketing analytics.
data: Programmatic import/export of contacts, people, leads for data portability and GDPR delete/edit requests.
Used for GDPR data-portability and right-to-erasure workflows.
// What to watch
- AI features depend on third-party LLM subprocessors (OpenAI, Anthropic) not individually enumerated in the Trust Center subprocessor list, though covered by AI data-privacy article and OpenAI DPA.
- Trust Center lists 'Personal health information' among data categories collected, but Nutshell publishes no HIPAA attestation/BAA - buyers handling PHI should not assume HIPAA coverage.
- Data residency is US-only with no EU/regional data hosting option - relevant for EU data-localization requirements.
- SOC 2 report, pen test letter, and CASA assessment are gated behind 'Request access' on the Trust Center (standard, but not openly downloadable).
- No bug bounty program (vendor-confirmed).
// At a glance
Pricing model
Per-user SaaS subscription, 5 tiers $13-$79/user/month (annual billing saves 15%); 14-day free trial, no credit card required
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Nutshell (a WebFX company)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.nutshell.com