Nucleus Security | Trust Center

Everything you need to complete your security review is here. Browse documents, certifications, and compliance details with confidence. Our Trust Center is regularly updated to reflect the latest audit results, and subprocessor disclosures.

Quick links

Website URL

Report a Vulnerability

Quick links

Website URL

Report a Vulnerability

Badges

FedRAMP Moderate

NIST CSF

Secure by Design Pledge

Our Philosophy

At Nucleus we believe in strong and accurate security measures. Our founders’ have a background working in vulnerability management for large data-sensitive organizations; security is a priority for the Nucleus team. We understand how important it is for our customers to trust our services and are committed to transparency in the controls we use to secure our entire infrastructure.

Jeff Gouge

Chief Information Security Officer

News

2026 SOC2 report now available

Quick Summary

One or more annual third-party audit(s)

Has a formal mobile device management (MDM) program

Annual third-party penetration testing

Has a disaster recovery plan

Subprocessors list available

Has cyber insurance

Will enter into a DPA

Has a bug bounty or vulnerability disclosure program

Deletes customer data on request

Has an API available

Uses a centralized IAM solution (SSO) to manage employee access

Has a status page

Has a privacy policy

Documents & Knowledge Base FAQs

What we offer

Nucleus

Risk Based Vulnerability Management Platform

Certifications: SOC 2 Type 2

NucleusGov

Risk Based Vulnerability Management Platform

Certifications: FedRAMP Moderate, SOC 2 Type 2

Featured Documents

Subprocessors16

Subprocessor

Location of Processing

Usage Details

Atlassian Jira

United States

Customer service.

Atlassian Statuspage

United States

Customer notifications about service health.

AWS

United States, Sweden, United Kingdom, Australia

Hosting for customer instances and their backups, and AI model hosting via AWS Bedrock. Customer data remains within selected AWS region.

Brevo

France

Relays commercial platform emails (not used for NucleusGov).

Cloudflare

United States

Content distribution, application security/abuse prevention, and DNS service provider.

Conveyor Inc.

United States

Trust portal with customer access and notifications.

gong.io

United States

AI note-taking and call transcription.

Google Cloud

United States

Optional hosting for customer instances and their backups. Customer data remains within selected GCP region.

Microsoft

United States

Used by Nucleus employees for customer communications via email, Teams, and related document collaboration. Employees may also use Copilot AI for work assistance.