Privacy policy and settings
This page provides the technical framework for configuring Nexthink privacy settings to collect, manage, access, and store data following compliance and security requirements within of your organization.
Infinity privacy settings
The following tables summarize the possible privacy configurations for Nexthink Infinity platform and Collector, along with their corresponding procedures and descriptions.
Go to the Infinity privacy policy section on this page for in-depth technical details about data privacy.
Refer to the Establishing a privacy policy documentation for privacy settings that apply to Nexthink V6 (on-premise) and Nexthink Experience.
Collector default configuration for data collection
| Privacy setting option | Description | Link to procedure |
|---|---|---|
Username and User Principal Name (UPN) | By default, Collector reports the username in a human-readable format. You can configure Collector to only report a hash of the username. Also, by default, Nexthink does not collect user principal name (UPN) information. | |
Focus time | By default, execution events do not contain information about how long the application is in focus. You can enable the tracking of the focus time. | |
User Activity | By default, Collector reports how much time the user spends actively using the device. You may configure Collector to disable reporting user activity time. | |
Wi-Fi network (SSID and BSSID) | By default, Collector does not gather the SSIDs and BSSIDs of the WiFi hotspots connected to the device. | |
Domain name | By default, Collector does not report domain names for network connections. | |
Network connections | By default, Collector gathers network connections for all binaries including destination attributes and connection metrics. |
Infinity platform privacy configuration options
| Privacy setting option | Description | Link to procedure |
|---|---|---|
Data management | Nexthink enables customers to anonymize and delete already collected user and device names. | |
Specific fields are encrypted at rest in AWS using an AES-256 key encryption. Nexthink provides a second layer of encryption using a unique key. | ||
Web Application | If the Nexthink browser extension is installed, usage data is collected by default. You can disable this option. Additionally, the Extension gathers more data such as web-based application URLs, if configured. | |
Device Location, Geolocation and Organization | By default, Nexthink determines whether a device connection is remote or on-site within your organization. Simillarly, the system defines the geographical location of a device based on its public IP address. Nexthink includes a rule-based assignment process to dynamically reassign the organization entities of devices, allowing setting proper View domain configurations. | |
View domain | Enforces compliance rules so that access to data is on a need-to-know basis. | |
User permissions | Nexthink provides four levels of data privacy that specify the access rights and visibility of each user account to particular pieces of information. | |
Single sign-on (SSO) | Single sign-on integration to facilitate user access to Nexthink through a single corporate login. | |
Collect URLs | By default, the system does not store URLs. If enabled, Nexthink sanitizes all collected URLs to conceal sensitive information. | |
Web Usage Time | By default, Nexthink collects the web usage time if a Web application is defined. |
Infinity privacy policy
Find below the pillars that build the Nexthink Infinity privacy policy:
Data encryption
Data collection
User permissions
Anonymization
Hosting locations
Data retention
Audit trails
Certifications and security reports
Data encryption
Nexthink encrypts the transmission of sensitive information using protocols. The table below describes the encrypted communication channels between components.
| Core components | Direction | Components | Protocol or encryption |
|---|---|---|---|
Collector | <--> | Nexthink web interface | TCP encrypted |
API (optional channel) | <--> | Nexthink web interface | REST HTTPS |
SSO integration (optional channel) | <--> | Nexthink web interface | SAML (HTTPS) |
In addition, Nexthink encrypts stored data by encoding it on disk. Each organization or customer has a unique key that prevents unauthorized access to data.
The Bring your own key (BYOK) encryption model allows you to manage your own unique encryption key, if required.
Data collection
Each endpoint communicates with a web instance provided and operated by Nexthink. Collectors installed on employee devices report events and metrics by:
Gathering hardware and software information.
Monitoring system activities and device properties.
In turn, authorized users can operate the Nexthink web interface to apply fixes to employee devices. Refer to the Collector overview documentation.
In addition to Collectors, Nexthink administrators can configure Nexthink browser extensions to monitor the usage and performance of web-based applications and software as a service (SaaS). Nexthink browser extensions only inspect URLs.
For a full map of the data collected by Nexthink, refer to the Data we collect and store and the NQL data model documentation.
The table below highlights some of the main objects and events collected by Nexthink.
Nexthink does not gather information about the content within files, emails, websites, or any other piece of content or application.
Devices |
|
Users and sessions |
|
Binaries and execution events |
|
Applications (desktop and web) | Usage and performance of configured applications. This applies to customers with the specific Nexthink product: Applications experience. |
Surveys and survey answers | With campaigns, Nexthink users can create employee surveys and store the answers. |
Networking and connectivity of the endpoints |
|
Zoom and Teams call data |
|
User permissions
Nexthink users can see and manage content depending on their role and permissions. Consider the following when setting up user permissions for privacy control:
During deployment, the system creates a Nexthink administrator as the admin account.
The main administrator can create user accounts for other administrators who are allowed to manage other users and roles.
Additional administrator accounts have access to all data.
Non-admin users can access personal data according to their roles.
Refer to the Accounts and Roles documentation.
User access to your organizational data
In addition to user permissions to manage content visibility, Nexthink provides a single sign-on (SSO) mechanism to facilitate user access to Nexthink through a single corporate login.
Nexthink access to your organizational data
Nexthink limits its access to your organizational data to specific individuals in accordance with data processing agreements, business needs and access controls.
Nexthink prevents unauthorized access by following a strict security protocol:
The Nexthink data inventory documentation lists data attributes and collected items by category and marks them as Personal data.
During periodic design reviews, the Nexthink Security and Privacy Committee sets requirements for storing and transmitting data, ensuring proper compartmentalization and access controls.
Personal data always remains within the customer production instance unless exported by the customer.
Nexthink grants access authorization to the platform and customer data separately.
Nexthink sets a request procedure to allow temporary access to specific resources in the AWS production environment for platform support or troubleshooting.
Authorized Nexthink employees may access the customer production instance solely for support.
Nexthink manages the access to production data on Amazon Web Services (AWS) systems through AWS SSO connected to Nexthink Okta identity provider (IdP), which relies on role-based access control limited to authorized personnel.
CloudTrail logs data access at all times. Access to virtual machines uses the secure shell (SSH) protocol on top of AWS Systems Manager (SSM).
Anonymization
Nexthink provides customizable data anonymization to specify the visibility of information according to user permissions.
Destinations and domains: Set to Hidden to hide destinations and domains of connectivity events from the user.
Devices: Set to Hidden to hide device names from the user.
Users: Set to Hidden to hide user names from the user.
The table below lists the visible attributes of destinations, domains, devices, and users.
Refer to the Configuring Collector level anonymization documentation for anonymization at Collector level.
| Data type | Attributes |
|---|---|
Destinations | Destination name IP address Nexthink UID Destination owner Destination Country Destination datacenter_region Destination Port Destination ip_subnet |
Domains | Domain name Nexthink UID |
Devices | Computer name Windows SID IP address Nexthink UID |
Users | Username Distinguished Name Full Name Nexthink UID |
Hosting locations
Nexthink uses AWS hosting locations in Europe, United Kingdom, United States of America, United Arab Emirates, Switzerland, and Australia.
Customers can choose a single region to store their data.
Data retention
Data retention periods vary according to the type of the data stored within the product. Refer to the Data resolution and retention documentation.
Data subject requests
Nexthink includes data management and GDPR features that allow Nexthink administrators to execute requests of data subjects:
Data retention timeframe for your Nexthink instance.
Data deletion of a specific device and its associated data.
Data retrieval of all the data associated with a specific user.
Data anonymization at a storage level, not conditioned by the user permissions.
Nexthink deletes all customer and end-user personal data after the expiration or termination of the agreement.
In addition, a customer may also request Nexthink for a copy of the personal data. In that case, Nexthink provides a copy within 30 days from the date of the request.
About data deletion
Nexthink procedure to delete customer data removes the entire data-related infrastructure, including operating systems (virtual machines) and storage resources (virtual disks). Consider the following:
Nexthink keeps the customer blob containing the backups for 90 days.
The daily backup procedure automatically destroys expired backups older than 90 days.
After 90 days, Nexthink permanently destroys the customer storage blob and the remaining backups (if any).
The Nexthink Site Reliability Engineering team can delete and destroy customer data before the scheduled date by receiving a written request from a customer delegate.
Audit trails
Nexthink captures actions performed by users with administrator rights that may impact the system, but audit trails are not a logging facility. This means the system exclusively audits the action and who performs it without logging the values set by the users' actions.
Refer to the Audit trail codes documentation for more information about audit logs.
Data sent to Nexthink
Nexthink collects non-personal data for Nexthink SA to provide value-added services to Nexthink customers.
Learn how to enable or disable these services to select which data you send to Nexthink in the article about Operational Analytics Information sent to Nexthink.
Certifications and security reports
ISO 27001
ISO 27017
ISO 27018 (“ISMS”)
ISO 27701 (“PIMS”).
The implementation and efficiency of this Security and Privacy management framework is annually audited by reputable independent third-party experts.
In addition, Nexthink regularly undergoes external audits to receive updated SOC 2 Type II reports on two trust services principles: security and availability. The detailed reports are available upon request and under a non-disclosure agreement (NDA).
Last updated