Privacy policy and settings
Last updated
Last updated
This page provides the technical framework for configuring Nexthink privacy settings to collect, manage, access, and store data following compliance and security requirements within of your organization.
The following tables summarize the possible privacy configurations for Nexthink Infinity platform and Collector, along with their corresponding procedures and descriptions.
Go to the Infinity privacy policy section on this page for in-depth technical details about data privacy.
Refer to the Establishing a privacy policy documentation for privacy settings that apply to Nexthink V6 (on-premise) and Nexthink Experience.
| Privacy setting option | Description | Link to procedure |
|---|---|---|
| Privacy setting option | Description | Link to procedure |
|---|---|---|
Find below the pillars that build the Nexthink Infinity privacy policy:
Data encryption
Data collection
User permissions
Anonymization
Hosting locations
Data retention
Audit trails
Certifications and security reports
Nexthink encrypts the transmission of sensitive information using protocols. The table below describes the encrypted communication channels between components.
In addition, Nexthink encrypts stored data by encoding it on disk. Each organization or customer has a unique key that prevents unauthorized access to data.
The Bring your own key (BYOK) encryption model allows you to manage your own unique encryption key, if required.
Each endpoint communicates with a web instance provided and operated by Nexthink. Collectors installed on employee devices report events and metrics by:
Gathering hardware and software information.
Monitoring system activities and device properties.
In turn, authorized users can operate the Nexthink web interface to apply fixes to employee devices. Refer to the Collector overview documentation.
In addition to Collectors, Nexthink administrators can configure Nexthink browser extensions to monitor the usage and performance of web-based applications and software as a service (SaaS). Nexthink browser extensions only inspect URLs.
For a full map of the data collected by Nexthink, refer to the Data we collect and store and the NQL data model documentation.
The table below highlights some of the main objects and events collected by Nexthink.
Nexthink does not gather information about the content within files, emails, websites, or any other piece of content or application.
Nexthink users can see and manage content depending on their role and permissions. Consider the following when setting up user permissions for privacy control:
During deployment, the system creates a Nexthink administrator as the admin account.
The main administrator can create user accounts for other administrators who are allowed to manage other users and roles.
Additional administrator accounts have access to all data.
Non-admin users can access personal data according to their roles.
Refer to the Accounts and Roles documentation.
In addition to user permissions to manage content visibility, Nexthink provides a single sign-on (SSO) mechanism to facilitate user access to Nexthink through a single corporate login.
Nexthink limits its access to your organizational data to specific individuals in accordance with data processing agreements, business needs and access controls.
Nexthink prevents unauthorized access by following a strict security protocol:
The Nexthink data inventory documentation lists data attributes and collected items by category and marks them as Personal data.
During periodic design reviews, the Nexthink Security and Privacy Committee sets requirements for storing and transmitting data, ensuring proper compartmentalization and access controls.
Personal data always remains within the customer production instance unless exported by the customer.
Nexthink grants access authorization to the platform and customer data separately.
Nexthink sets a request procedure to allow temporary access to specific resources in the AWS production environment for platform support or troubleshooting.
Authorized Nexthink employees may access the customer production instance solely for support.
Nexthink manages the access to production data on Amazon Web Services (AWS) systems through AWS SSO connected to Nexthink Okta identity provider (IdP), which relies on role-based access control limited to authorized personnel.
CloudTrail logs data access at all times. Access to virtual machines uses the secure shell (SSH) protocol on top of AWS Systems Manager (SSM).
Nexthink provides customizable data anonymization to specify the visibility of information according to user permissions.
Destinations and domains: Set to Hidden to hide destinations and domains of connectivity events from the user.
Devices: Set to Hidden to hide device names from the user.
Users: Set to Hidden to hide user names from the user.
The table below lists the visible attributes of destinations, domains, devices, and users.
Refer to the Configuring Collector level anonymization documentation for anonymization at Collector level.
Nexthink uses AWS hosting locations in Europe, United Kingdom, United States of America, United Arab Emirates, Switzerland, and Australia.
Customers can choose a single region to store their data.
Data retention periods vary according to the type of the data stored within the product. Refer to the Data resolution and retention documentation.
Nexthink includes data management and GDPR features that allow Nexthink administrators to execute requests of data subjects:
Data retention timeframe for your Nexthink instance.
Data deletion of a specific device and its associated data.
Data retrieval of all the data associated with a specific user.
Data anonymization at a storage level, not conditioned by the user permissions.
Nexthink deletes all customer and end-user personal data after the expiration or termination of the agreement.
In addition, a customer may also request Nexthink for a copy of the personal data. In that case, Nexthink provides a copy within 30 days from the date of the request.
Nexthink procedure to delete customer data removes the entire data-related infrastructure, including operating systems (virtual machines) and storage resources (virtual disks). Consider the following:
Nexthink keeps the customer blob containing the backups for 90 days.
The daily backup procedure automatically destroys expired backups older than 90 days.
After 90 days, Nexthink permanently destroys the customer storage blob and the remaining backups (if any).
The Nexthink Site Reliability Engineering team can delete and destroy customer data before the scheduled date by receiving a written request from a customer delegate.
Nexthink captures actions performed by users with administrator rights that may impact the system, but audit trails are not a logging facility. This means the system exclusively audits the action and who performs it without logging the values set by the users' actions.
Refer to the Audit trail codes documentation for more information about audit logs.
Nexthink collects non-personal data for Nexthink SA to provide value-added services to Nexthink customers.
Learn how to enable or disable these services to select which data you send to Nexthink in the article about Operational Analytics Information sent to Nexthink.
ISO 27001
ISO 27017
ISO 27018 (“ISMS”)
ISO 27701 (“PIMS”).
The implementation and efficiency of this Security and Privacy management framework is annually audited by reputable independent third-party experts.
In addition, Nexthink regularly undergoes external audits to receive updated SOC 2 Type II reports on two trust services principles: security and availability. The detailed reports are available upon request and under a non-disclosure agreement (NDA).
| Core components | Direction | Components | Protocol or encryption |
|---|---|---|---|
| Data type | Attributes |
|---|---|
Nexthink maintains a set of policies and standard operating procedures. A Security and Privacy management framework in accordance with:
Refer to the documentation for a detailed overview of the most important security measures.
Also, the documentation includes information about the Nexthink privacy program and an extensive FAQ section.