Privacy policy.
How we secure the Nanoheal platform, then what we collect when you visit this website or send the demo form, why, and what you can ask us to do with it.
Last updated 18 October 2026
How we secure the Nanoheal platform
Security is paramount at Nanoheal. We are committed to safeguarding your application data, mitigating system vulnerabilities, and guaranteeing uninterrupted access. We employ industry-standard technologies and services to protect your data from unauthorised access, disclosure, use, and loss. All Nanoheal employees undergo security training during onboarding and annually thereafter. Our security programme is overseen by a dedicated Security Officer.
Vulnerability disclosure
To report a security vulnerability or express a security concern regarding a Nanoheal product, please contact us at security@nanoheal.com.
Infrastructure and network security
- Physical access control: Nanoheal leverages the robust security infrastructure of Amazon Web Services (AWS). AWS data centres employ a layered security approach, including:
- Custom-designed electronic access cards
- Alarms
- Vehicle access barriers
- Perimeter fencing
- Metal detectors
- Biometrics
- Access logs, activity records, and camera surveillance
- Regular patrols by professional security guards
Nanoheal employees do not have physical access to AWS data centres, servers, network equipment, or storage.
- Penetration testing: Independent, third-party penetration testing is conducted on the Nanoheal platform after major releases. We provide penetration test results and mitigation details to our enterprise customers upon request.
- Third-party audits: AWS undergoes regular independent audits, including SSAE 16-compliant SOC 2 and ISO 27001 certifications, verifying compliance controls for its data centres, infrastructure, and operations. Nanoheal holds a SOC 2 Type I report, available on request, and is working toward SOC 2 Type II. We will update this section when the Type II report is issued.
- Intrusion detection and prevention: We prioritise monitoring for unusual network patterns and suspicious behaviour. AWS’s intrusion detection and prevention systems (IDS/IPS) use both signature-based and algorithm-based security to identify attack patterns. This includes controlling the attack surface, deploying intelligent detection controls, and implementing automated remediation technologies. While we don't provide direct access to security event forensics, our engineering and customer support teams are available during and after any unscheduled downtime.
Business continuity and disaster recovery
- High availability: The Nanoheal service uses redundant servers (e.g., multiple load balancers, web servers, replica databases) to ensure continuous operation. Servers are taken offline for maintenance without impacting availability.
- Business continuity: Encrypted data backups are continuously maintained in multiple AWS regions. In the event of production data loss, we will restore your data from these backups.
- Disaster recovery: In a region-wide outage, we will deploy a duplicate environment in a different AWS region.
Data transit
- Data in: All incoming connections to our servers require industry-standard TLS encryption.
- Data between servers: Connections between our servers are encrypted via TLS with 256‑bit AES encryption. Secrets like database passwords and API keys are also encrypted using 256‑bit AES encryption.
- Data out: Responses are sent over HTTPS, encrypted with TLS.
Data security and privacy
- Data encryption: All data on Nanoheal servers is encrypted at rest using AWS’s Key Management Service. This protects data even if physical storage devices are compromised. Data is also encrypted in transit using HTTPS TLS.
- Data retention: Nanoheal retains data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and support our business operations. Specific retention periods vary depending on the type of data and the applicable legal and regulatory requirements. Our data retention policies set out the specific timeframes for retaining different categories of data. These policies are regularly reviewed and updated as needed.
- Data removal: Users may request the deletion of their data, subject to certain exceptions, such as legal obligations or ongoing contractual relationships. Upon a valid data deletion request, we will securely and permanently remove the data from our systems. Please submit the data deletion requests at privacy@nanoheal.com. Please note that some data may be retained in anonymised or aggregated form for analytical purposes.
- Personal data on the platform: The Nanoheal agent collects device and digital-experience telemetry, which can include personal data such as device and user identifiers, and the answers employees give in sentiment surveys. For this data the customer is the controller, and Nanoheal processes it on the customer's instructions under a data processing agreement. What is collected, who can see it, whether it is anonymised and how long it is kept follow each customer's configuration. Haya masks the fields a customer declares as personal, and server-side filtering can stop the collection of identifiers such as system serial numbers. We do not collect sensitive information such as credit card numbers, IBANs or social security numbers.
Security training
All employees receive comprehensive onboarding and systems training, including security policies, software development best practices, and ethical guidelines. Engineers undergo additional security policy reviews and contribute to policy development through internal documentation. Policy changes are communicated through pull requests and email notifications.
Disclosure policy
Nanoheal follows the SANS incident handling and response process, encompassing identification, containment, eradication, recovery, communication, and documentation of security events. Customers are notified of data breaches as soon as possible via email and phone, with regular updates provided throughout the incident.
Incident response plan
We maintain a well-defined incident response plan with clear roles and responsibilities:
- Level 1: Initial triage and escalation.
- Level 2: Security Officer classifies the incident and activates the Security Incident Response Team (SIRT).
- Level 3: Security Officer or CEO communicates with affected parties.
Our process includes:
- Triage: Verification of the incident and initial impact assessment.
- Escalation: Immediate escalation to Level 2 and then Level 3.
- Classification: Determining the severity and scope of the incident.
- Investigation: Analysis of the incident to identify root causes.
- Lessons learned: Implementing preventative measures and improving future processes.
Questions about platform security
For any questions about how we secure the platform, please contact us at security@nanoheal.com.
Privacy notice for visitors to this website
This section explains what this website collects about you, why, and what you can ask us to do with it. The sections above describe how we secure the Nanoheal platform; the two sections below give more detail on analytics and ticket exports.
Who we are
This website is run by HFN Inc., headquartered in Orem, Utah, United States (“Nanoheal”, “we”). Our engineering team is in India. We decide how the personal data collected on this website is used, so we are its controller. For questions about your personal data, write to privacy@nanoheal.com.
What we collect
- When you browse: Cloudflare Web Analytics counts page views without cookies and without identifying you. If you accept analytics cookies, Google Analytics also records the pages you visit and how you arrived. Our hosting provider processes your IP address and browser details to deliver pages and protect the site.
- When you send the demo form: your work email, and your name, company, role and call drivers if you give them.
- When you subscribe to the newsletter: your work email, and your name, company, role and any topic you suggest, if you give them.
- If you attach a ticket export: the file and its name. A ticket export can contain other people's personal data, which is why we recommend anonymising it first.
- The bot check: Cloudflare Turnstile may process your IP address and browser details to check that the form is sent by a person.
- On your device: your cookie choice and your light or dark theme setting are kept in your browser's local storage. They are not sent to us.
Why we use it, and on what legal basis
- To answer your request and prepare your coverage review: our legitimate interest in replying to a business enquiry you started, and in taking steps you asked for before a possible contract.
- To send you the newsletter: your consent, given when you subscribe. You can withdraw it at any time by replying to any issue or writing to privacy@nanoheal.com.
- To keep the website secure and working (hosting, the bot check, cookie-free page counts): our legitimate interest in running a secure website.
- Google Analytics: switched off at the moment; once it is on, only with your consent, which you can then withdraw at any time from Cookie settings in the footer.
We do not sell your personal data, use it for advertising, or use ticket exports to train models.
Who receives it
Only the Nanoheal staff who answer requests and prepare reviews, and the service providers that run the website for us: Amazon Web Services (storage of ticket exports and of a copy of each form request, and the emails that tell our team about a request), Cloudflare (analytics and the bot check), the company that hosts this website, the provider that delivers our email and, if you accept analytics cookies, Google. They act on our instructions.
How long we keep it
- Ticket exports: deleted automatically 30 days after they arrive.
- The stored copy of a form request: deleted automatically 30 days after it arrives.
- Demo-form details: kept while we are in contact with you, and deleted 24 months after our last contact.
- Newsletter subscriptions: kept until you unsubscribe.
- Google Analytics data: deleted after 14 months.
International transfers
Nanoheal and its providers work in more than one country, so your data may be processed outside the country where you live, including in the United States, where Nanoheal is headquartered, and India, where our engineering team works. Ticket exports are stored in an Amazon Web Services region we choose for the review. Where data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or on standard contractual clauses. Ask us at privacy@nanoheal.com for a copy of the safeguards.
Your rights
Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, limit how we use it, or send it to you in a portable format. You can object to our use of it based on legitimate interests, and withdraw consent at any time without affecting what was done before. To make a request, write to privacy@nanoheal.com; we will reply within one month. You can also complain to the data protection authority where you live or work.
If your employer uses Nanoheal
This notice covers this website only. If your employer uses the Nanoheal platform, your employer decides what data the platform collects about you; see Personal data on the platform above, and ask your employer for its own privacy notice.
Analytics on this website
We use Cloudflare Web Analytics to count page views. It uses no cookies and does not identify you. Google Analytics is switched off at the moment, so this website sets no analytics cookies and shows no cookie banner. If it is switched on, it will measure which pages are visited and how people arrive only after you accept analytics cookies on the banner, using the cookies listed in the cookie policy.
Ticket exports sent through the demo form
This section covers the optional ticket export you can attach on the demo page.
What we receive
The file you attach: a CSV, TSV or Excel (.xlsx) export of service-desk tickets, up to 25 MB. With it we receive what you typed into the form: your work email, and your name, company, role and call drivers if you gave them, together with the file’s name. Ticket exports often contain other people’s personal data, such as employee names, email addresses and device names. We recommend removing or replacing those before sending; an anonymised export works just as well for the review.
Why we use it
Only to prepare your coverage review: to work out which of your tickets the Nanoheal automation library already resolves, which would need new automations, and to show the largest ones resolving on a live endpoint. We do not use it for marketing, to train models or for any other customer.
Where it is kept
The file goes from your browser straight to a private storage bucket on Amazon Web Services. It does not pass through this website. The bucket blocks all public access, accepts connections only over encryption in transit, and encrypts files at rest. Each file is scanned for malware by Amazon GuardDuty before anyone can open it; a file in which a threat is found cannot be opened and is deleted within a day. Once the scan is complete, an email with your form details, the file’s location and the scan result is sent to the Nanoheal team preparing reviews.
How long we keep it
Files are deleted automatically 30 days after they arrive. If you would like yours deleted sooner, ask through the contact form or your Nanoheal contact.
Who can see it
Only the Nanoheal staff preparing your review.
The bot check
To stop automated abuse of the upload, the demo form may run Cloudflare Turnstile, which checks that a request comes from a person. Cloudflare processes technical information about your browser and connection, such as your IP address, to do this, under its own privacy policy.
The request itself
When you send the demo form, what you typed (your work email, and your name, company, role and call drivers if you gave them) is emailed to the Nanoheal team preparing reviews, so they can reply to you. A copy is also kept in our private Amazon Web Services storage for 30 days, so your request isn’t lost if an email fails. It is used only to answer your request.
If you send nothing
The export is optional. You can describe your call drivers in the form instead, and nothing is uploaded.