Simply fill out the form and we’ll be in touch soon.
Built-in enterprise security and trust
nudge is certified to the highest independent standards for information security, data privacy controls, and responsible AI management. This page covers what those certifications mean in practice and our Trust Center gives your security team direct access to audit reports, pen test summaries, compliance documentation, and policies.
privacy and governance
Three pillars of protection
nudge operates at the intersection of employee financial data, human coaching, impartial guidance, and global enterprise deployment. That combination demands a higher standard of security, privacy, and AI governance than most HR technology providers face. Here is how we meet it.
Security
Enterprise-grade protection built into the platform architecture, not layered on top. ISO 27001 certified, independently penetration tested, and continuously monitored.
Data privacy
Employee financial data is sensitive. nudge treats it that way. Privacy controls are embedded at every layer, across every market nudge operates in, from GDPR and CCPA through to LGPD and PIPEDA.
Responsible AI governance
AI that handles impartial financial guidance for a global workforce needs a governance framework to match. nudge is ISO 42001 certified, one of the first organizations in the world to achieve this standard. With human oversight, full audit trails, and deterministic outputs that procurement and legal teams can verify.
security
Enterprise security from the ground up
Data protection isn't just a compliance requirement. It's a precondition for employees trusting the platform enough to share the information that makes personalization possible. nudge invests in security at every layer: the architecture, the development process, access controls, and the independent parties we bring in to find what we've missed.
Independently certified, not self-assessed
ISO 27001 is not a one-time audit. It requires ongoing independent assessment, year after year. nudge's information security controls are verified by an accredited third party.
Tested by people paid to break it
nudge commissions independent penetration tests covering the platform, its services, and its infrastructure. What they find gets fixed.
Encrypted in transit and at rest
All data transmitted to and from the nudge platform is encrypted in transit. Data at rest is encrypted using industry-standard methods. nudge's platform consistently achieves A-grade security ratings from independent testing tools.
Enterprise infrastructure
nudge runs on Microsoft Azure with continuous status monitoring, anti-DDoS protection, Web Application Firewall controls, and a 24-hour recovery time objective. The architecture is built for the availability an enterprise workforce program demands.
data privacy
Privacy that respects every employee
Employees share personal information with nudge for one reason: so the experience is relevant to them. nudge uses it for exactly that, nothing else. No third-party sharing, no advertising, no commercial agenda beyond making the program work for the person using it.
Data is never sold or shared with third parties
nudge has no commercial relationships with financial product providers and runs no advertising model. Employee data is processed for one purpose only: delivering personalized financial guidance through the nudge platform.
We absorb the compliance burden
nudge manages consent, handles subject access and deletion requests, maintains audit logs, and takes on the regulatory obligations that come with processing financial data across multiple jurisdictions. Your legal and HR teams get a platform that has already done the compliance work.
Employers see the workforce.
Never the individual. HR and Total Reward teams receive anonymized, aggregated workforce insight through nudge's analytics dashboard (nudgenomics). No individually identifiable data is ever surfaced to managers, HR teams, or anyone within the employing organization.
Global coverage. No gaps
nudge operates across markets with materially different privacy frameworks, whether that's GDPR in Europe, CCPA in California, LGPD in Brazil, or PIPEDA in Canada. Each is built into the platform's compliance architecture, not handled as a regional exception.
AI Governance
AI that can be trusted for impartial financial guidance
When AI gives employees guidance on their 401(k), their HSA, their debt, or their retirement, accuracy is not negotiable. Neither is consistency, impartiality, or the ability to explain every output. nudge holds ISO 42001 certification for responsible AI management. One of the first organizations in the world to achieve this standard and governs its AI accordingly.
ISO 42001 certified AI management
nudge is independently certified to ISO/IEC 42001:2023 for AI management systems, integrated with ISO 27001 and GDPR. The certification covers defined governance roles (AI Governance Lead, Ethics Officer, DPO, Risk Lead), AI System Impact Assessments with approval sign-off before any deployment, and a documented policy suite covering AI risk management, data governance, third-party AI accountability, monitoring, and incident management.
Deterministic by design, not probabilistic
nudge's AI is rules-based and deterministic: the same employee profile produces a consistent, auditable output every time. This is a deliberate architectural decision. General-purpose AI tools are probabilistic, the same question can produce a different answer depending on when and how it's asked. Across a workforce of thousands in multiple markets, that inconsistency is a governance problem. nudge's approach eliminates it.
Human-in-the-loop oversight
For sensitive use cases, human oversight is mandatory. nudge's personal finance and behavioral science experts review AI outputs, refine guardrails, and validate accuracy across every market before deployment and on an ongoing basis. AI System Impact Assessments are completed and signed off before any new AI feature goes live.
Aligned to international AI standards
nudge's AI governance framework aligns with ISO 42001, ISO 27001, the NIST AI Risk Management Framework, the OECD AI Principles, and the EU AI Act. The LLMs integrated into client-facing services are accessed via enterprise-contracted APIs (Microsoft Azure AI, Google AI, IBM AI Engineering). Not public endpoints with vendor accountability built into every contract.
faq
Have questions? Find answers
Mollit ad ea labore aute deserunt commodo sit amet ut. Ut ad labore veniam ea. Voluptate in eu sunt excepteur duis culpa.
Does nudge use employee data to train AI models?
No. Employee data processed through the nudge platform is never used to train AI models. Model-training environments use only anonymized or pseudonymized data, governed by nudge's Data Governance for AI policy. The LLMs integrated into nudge's platform are accessed via enterprise-contracted APIs. Not public endpoints with every AI vendor contractually prohibited from using nudge data for model training or any purpose outside direct service delivery.
Can our security team access audit reports and penetration test results?
Yes. nudge's Trust Center provides direct access to ISO 27001 and ISO 42001 certificates, the current Statement of Applicability, the Cyber Essentials certificate, and the CAIQ and SIG Lite self-assessment questionnaires. The most recent penetration test report and vulnerability assessment report are available under NDA. Please get in touch to request access.
Can we see what individual employees are doing on the platform?
No. Employer reporting through nudge's analytics dashboard (nudgenomics) is always anonymized and aggregated to the workforce level. No personally identifiable information is ever surfaced to HR or reward teams. Individual employee financial data, AI interactions, and coaching conversations are never accessible to the employer. This is an architectural decision, not a configurable setting.
What certifications does nudge hold?
nudge holds ISO/IEC 27001 certification for information security management and ISO/IEC 42001:2023 certification for AI management systems, independently audited and current. nudge also holds Cyber Essentials certification and is ICO registered. The platform has an A+ rating from Qualys SSL Labs and an A rating for security headers. All certificates and supporting documentation are available in the Trust Center.
How does nudge handle financial guidance compliance across different markets?
nudge's platform is built around impartial financial guidance, not financial advice. nudge's philosophy is "educate, empower, never prescribe": the platform helps employees understand their options and build the confidence to act, but does not provide regulated financial advice, recommend specific financial products, or tell employees what to do. This distinction keeps nudge outside the scope of financial services regulation in most markets while ensuring the guidance employees receive is genuinely useful. Where employees need regulated advice, the platform signposts them to find a licensed advisor.