Privacy Policy

Account information. Your email address, a hashed form of your password, whether the email has been verified, and, for your profile, your first name, last name, job title, and optionally a phone number.

Organization information. The organization name you choose, its place in a parent organization if you use portfolio mode, and the profile you fill in about the business: industry, employee band, revenue band, and whether the business has had a formal assessment before.

Assessment content. Everything you enter while running an assessment. That means the name you give the assessment, the level you pick for each control, any notes you write (free text, up to 10,000 characters a control), the reason you give when you skip a control, your answers to follow-up questions, and the context you provide at the start about how your business operates, such as how your IT is run, what kinds of data you hold, whether you carry cyber insurance, whether you have had an incident, who holds administrator access, how payments leave the business, which rules or customer terms apply to your work, when your next review is due, and the time and budget you have for security. Some of this is sensitive business information, and it is treated as such.

Roadmap progress. If you track progress on your roadmap, we store the status you set for each item, the date, and the short note you add (up to 240 characters).

Purchase records. If you unlock a report, we record the amount, any discount, the sales tax charged, the currency, the status, the timestamps, and the payment processor’s reference identifiers for that payment, plus a customer identifier from the payment processor on the organization. We never receive or store your card number, expiry date, or security code. Payment happens on our payment processor’s own hosted checkout page, and card details go directly to the payment processor. To work out sales tax, that checkout page also asks for a billing address, and may ask for a business name and tax ID. The payment processor keeps those details; we do not store them.

Invitations. If you invite someone to your organization, we store the email address you give us and the role you assign, so we can send and track the invitation.

Contact messages. If you use the contact form, the name, email address, and message you send are emailed to us through our email delivery provider. They are not stored in the NISTnow database.

Deletion requests. If you ask us to delete your account, we store the request, its dates, and any reason you choose to give.

Technical and security records. To keep your account secure we keep session records and an audit log of actions taken on accounts and data: who did what, in which organization, when, and whether it succeeded. In those records your IP address and browser user-agent string are stored only as a one-way hash, never in a readable form, and some audit entries also hold a one-way hash of the email address involved. Separately, the load balancer our hosting provider places in front of the site keeps ordinary web server request logs, and those do contain your IP address and user-agent in readable form. We use them only to keep the service running and to block abuse, and they are deleted after 90 days. We also keep counts of failed sign-in attempts so an account can be locked temporarily after repeated failures.

We do not collect special categories of personal data, and we ask you not to put personal details about individuals into your assessment notes. Notes are a place for business context, not for personnel records.

We use what we collect only to run NISTnow for you. Specifically:

• to create and secure your account, and to sign you in;
• to run your assessment and produce your analysis, your report, and your exports;
• to take payment and to record which reports your organization has unlocked, including revoking access if a payment is refunded in full or disputed;
• to send you the transactional emails the service depends on: email verification, password reset, organization invitations, and confirmations about a deletion request;
• to keep the service working and secure, including preventing abuse, investigating incidents, and fixing errors;
• to answer you when you contact us;
• to meet legal, tax, and accounting obligations.

We do not sell your personal data, and we do not share it with anyone for advertising. We do not run advertising on NISTnow, we do not build advertising profiles, and we do not send marketing emails. We do not use your assessment answers to train machine-learning models.

You and your organization. Data belongs to an organization, and the people in that organization can see it. Owners can see everything in the organization and manage its members and settings. Members can see and answer assessments. Viewers can read them but not change them. If your organization sits under a parent organization in portfolio mode, a portfolio operator appointed at the parent reaches your organization too, with the same access a member has: they can see your assessments in full, including the answers, the notes, and the assessment context, they can download your reports, and they can answer and submit assessments. On top of that they get a consolidated view of scores and assessment status across the whole portfolio. The one thing a portfolio operator cannot see is your member list. The list of member email addresses is visible only to an organization’s own owner.

If you invite someone to your organization, or accept a place under a parent organization in portfolio mode, you are choosing to show them that organization’s assessment content. Please do both deliberately.

Us. The owner can access account and support records when needed to operate the service, respond to you, or investigate a problem. Administrative actions on accounts are recorded in the audit log.

Nobody else, except the service providers listed below, and except where we are legally required to disclose something, need to protect the safety of a person, or need to enforce our terms. If NISTnow is ever transferred to someone else, your data would move with the service, and we would tell you before that happened.

A small number of service providers process data on our behalf so the service can run. They are bound by their own agreements with us and may use the data only to provide their service.

• Our hosting provider. Hosting, the application database, backups, and system logging. Your data is stored in the central United States.
• Our payment processor. Payment processing and sales tax. It receives your email address and the payment details, billing address, and any business name or tax ID you enter on its own checkout page, and handles the card data itself.
• Our email delivery provider. Sending email. It receives the recipient address and the content of the email we send you, and the name, email address, and message of any contact form you send us.
• Our domain name and email forwarding provider. Directing the nistnow.com name to our hosting provider, and forwarding email sent to a nistnow.com address, such as info@nistnow.com, to our inbox. It receives the content of any email you send to those addresses. It does not handle traffic to the website itself.
• Our error monitoring service. So we can find and fix problems. It is configured not to attach personal data to error reports. On the server, cookies, request bodies, query strings, and the headers that carry credentials are redacted before an error is sent, and any secret value is masked wherever it appears. In the browser, cookies and headers are removed entirely. Screen recordings are captured only when an error happens, with all text and inputs masked and network request bodies excluded.
• Our bot detection service. It checks that the sign-up, password reset, and contact forms were sent by a person and not by an automated program. For that check it receives the visitor’s internet address and technical details about the browser. It does not receive what the visitor typed into the form. Not in use at present.
• Our web analytics service. Not in use at present. If we turn it on, it will measure page views on our public pages only, so we can tell which of them are read. It would receive the address of the page and ordinary technical details of the visit, such as browser type. It sets no cookies, does not identify individual visitors, and does not follow you across other sites. It would not run on the signed-in application.

NISTnow is operated from the United States, and your data is stored and processed there. If you use NISTnow from another country, you are sending your data to the United States.

NISTnow sets two cookies, and both are strictly necessary for the service to work. There are no advertising cookies and no analytics cookies. The analytics service described above is not in use; if we turn it on, it sets no cookies, does not profile individual visitors, and does not follow you across other sites. Fonts are served from our own servers, not from a third party.

• nn_session keeps you signed in. The cookie holds a random token, not your details, and the server stores only a hash of it. It cannot be read by scripts in your browser, and it is sent only over HTTPS. It is not sent when another site makes a background request to NISTnow, only when you navigate here yourself.
• nn_csrf protects you against cross-site request forgery, by letting the site prove that a request you make really came from you.

NISTnow also stores two small preferences in your browser’s local storage: whether you have collapsed the sidebar, and which product update you have already seen. They never leave your browser and they identify nothing about you.

A session stays valid for up to 7 days of inactivity and in all cases no more than 30 days from sign-in, after which you sign in again. You can sign out at any time, which invalidates the session on the server as well as in your browser. Changing your password signs out every other session. If you block these cookies, you will not be able to sign in.

We keep your account and assessment data for as long as your account is open, so you can come back and see how far you have come. You can delete your account at any time from your account settings by confirming with the word DELETE.

When you request deletion, your account is disabled immediately and all of your sessions are signed out, so the account cannot be used while the deletion is carried out. Unless the request is held up by the shared-organization rule described below, your data is then permanently deleted within 7 days of your request. We email you when it is done.

What is permanently deleted: your user record, your profile, your sessions and any outstanding email verification or password-reset tokens, the invitations you sent, your organization memberships, and, for organizations you alone own, the organization, its profile, and all of its assessments including every answer, note, follow-up answer, assessment context, and roadmap progress entry.

What is kept, and why:

• Purchase records, because we are required to keep records of transactions for tax and accounting purposes. The link to your user account is removed. What stays is the amount, the currency, the status, the dates, and the payment processor’s reference numbers for the payment, which the processor can still match to its own record of the transaction. We also keep the deletion request itself, including any reason you gave, with your account unlinked from it.
• Security audit records, because they are the log that makes access to data traceable and accountable. They contain identifiers, hashed IP addresses, and, for some events, a hashed email address, not your assessment content. Copies kept in our log storage are deleted after 400 days; the audit table in the database is kept for as long as the service runs.
• Web server request logs, which contain IP addresses in readable form, until they are deleted 90 days after the visit.
• Data in organizations you share with other people. If an organization has other members, its assessments belong to those members too and are not deleted. Your name is unlinked from them. An organization you own that has other members has to be handed over or emptied before your account can be deleted.
• An anonymous record of your assessment scores. When an assessment is submitted, we keep a record of its scores alongside the industry, employee-count band, and revenue band you selected for the organization, and the date. We use it to work out averages, so that we can eventually show businesses how their results compare with others of a similar size in a similar industry. This record contains no name, no email address, no organization, and none of your answers or notes, and it holds nothing that links it back to you or your business. Because there is nothing in it to identify, it is not deleted with your account.
• Invitations other people sent to you. An invitation to join someone else’s organization is that organization’s record, and it is addressed to your email address rather than to your account. Those are not deleted with your account. If you want one withdrawn, ask the organization that sent it, or reach us through the contact page.

Reports are not stored anywhere. Each PDF is generated fresh from your answers at the moment you download it and is not retained by us afterwards. A copy you have already downloaded is on your own device and is outside our control.

Backups of the database are kept on a rolling basis for disaster recovery, and the oldest is about 35 days old. Deleted data can therefore persist inside a backup until that backup expires. Backups are never used to bring deleted data back into the live service.

You can download a copy of your data at any time, from your account settings. It covers your account, your profile, and the organizations you own. The export is a ZIP file containing:

• your account record: your identifier, email address, when it was verified, and when the account was created;
• your profile: first name, last name, job title, and phone number;
• the organizations you own, with their profiles, and the list of organizations you belong to with your role in each;
• the assessments in the organizations you own, in full: every answer, note, reason code, follow-up answer, the assessment context, and the roadmap progress entries;
• your purchase records, with the payment processor’s identifiers removed: amount, currency, status, and dates;
• a PDF report for each submitted assessment in an organization you own, where that report has been unlocked.

Your password hash is never included. A few things are deliberately outside the export. Assessments in organizations you belong to but do not own are not included, because that content belongs to the organization rather than to you. Neither are the security audit log and the session records, because handing those out would defeat the purpose of keeping them. Messages you have sent through the contact form are not included either, because they live only in our email inbox and never reach the NISTnow database. If you need any of those, ask us through the contact page. The export is limited to a few requests per hour, to protect the service.

Depending on where you live, you may also have rights to access, correct, delete, or restrict the use of your personal data, or to object to it. You can do most of this yourself from your account settings. For anything else, use the contact page and we will respond.

We take security seriously, because a tool about cybersecurity that was careless with your data would not be worth much. No online service can be made perfectly secure, and we will not claim otherwise. What we do:

• all traffic is encrypted in transit with HTTPS, and any unencrypted request is redirected to the encrypted site;
• data is encrypted at rest using our hosting provider’s default encryption, and the database only accepts encrypted connections;
• passwords are stored as Argon2id hashes with parameters tuned to current guidance, never in a readable form;
• sessions use random opaque tokens stored only as hashes, and can be revoked from the server;
• an organization is derived from your verified session on the server, never from anything your browser tells us, so one organization cannot reach another’s data;
• credentials and keys are held in a managed secret store, not in the application code;
• sign-in, contact, payment, and download endpoints are rate limited, and repeated failed sign-ins lock an account temporarily;
• actions on accounts and data are recorded in an audit log, with IP addresses stored only as a one-way hash;
• every page of a free preview report you download is watermarked with your email address and the time, so a leaked copy can be traced back to the download it came from; an unlocked report carries your organization’s name and the word “Confidential” on each page;
• the database is backed up daily, with point-in-time recovery for the last 7 days, and backups are retained for about 35 days for disaster recovery.

If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.

NISTnow is a business tool for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

We may update this policy as NISTnow changes or as the law requires. When we do, we update the “Last updated” date at the top of this page. If a change materially affects how we handle your data, we will give you notice at the email address on your account before it takes effect.

Questions about this policy, or about the data we hold on you, should go through the contact page, or by email to info@nistnow.com. We will reply to the email address you write from.