Security & Data Handling

Last updated: October 29, 2026

How we get access to Cityspan

You add us as our own user on your grant in Cityspan, the same way you would add a staff member. You never share your password with us. Everything we do shows up in Cityspan under that user, and you can remove it at any time, which stops our access immediately.

Where the service runs

The automation runs as short scheduled jobs on a dedicated server that Nimbusworks owns and operates in the United States. Your program's working database is hosted on Cloudflare, which encrypts it in storage. Every connection to Cityspan and to our other providers is encrypted.

Credentials

The Cityspan login you create for us is stored on our server in a file that only the service can read. It is read only when a job runs and is never written into an email or a report. Each customer's login and settings are kept in a separate file, and a job for one program cannot load another program's login.

Your data kept separate

Each customer's working data is kept in its own database, so one program's records are never mixed with another's, and deleting your data removes exactly your data.

What we do and don't decide

We enroll participants, file attendance, and correct records you tell us are wrong. We never decide consent for a child. Consent and release fields are recorded exactly as your program's forms or written instructions say. When something is missing, we flag it by name for your staff to resolve.

Data minimization

Attendance is filed by Cityspan PersonID. Student names are not included in the attendance files we upload.

Every run is checked and logged

Each write is previewed before it is made and re-read from Cityspan afterward. If the numbers don't match, the run is recorded as a failure, not a success, and we are alerted. Run logs are kept with timestamps so you can show a funder what was reported and when. A separate health check alerts us if a scheduled run fails or does not happen.

Who can reach it

Only Nimbusworks staff can administer the service. Code is deployed only from committed, version-controlled releases, each stamped with its version, and every run records which release did the work.

Your data, your control

We never sell or share your data. When you leave, we stop all runs, you remove our Cityspan user, and we export your records on request and then delete them.

Service providers

We use a small set of providers to run the service: Cloudflare (website and working database), Google Workspace (email), and Anthropic (an AI assistant that helps us draft replies to your emails; a person reviews every one before it is sent). They process data only as needed to run the service.

Responsible disclosure

Found a security issue? Email [email protected] and we'll respond promptly.