Prominent Fortune 500 companies trust Nimway as their smart office solution. Why? It’s simple. Nimway is based on a philosophy of security by design—meaning that even the most security-conscious companies in banking and pharmaceuticals can have peace of mind. Here are the features baked into Nimway from day one that establish trust in your smart office.
Email address, name, profile photo: The email address, name, and profile photo (optional) of users are collected through the Nimway mobile app. This data is used to represent the user in the Nimway service. Also, a user’s corporate email address is what authenticates them, and users can only access data within their email domain.
Calendar appointments: Data about users’ calendar appointments is collected remotely from the company calendar server. Nimway stores the start and end times, meeting title, and meeting room. This data supports Nimway wayfinding on the digital floorplans and is used to manage time-to-go notifications on mobile apps.
Device ID: Device ID is collected in most API requests. This data is used to separate data when a user has multiple mobile devices.
Facility data: Nimway collects and stores building data. Static information is collected initially and can be modified in the Nimway management tool e.g., building maps and meeting room details. Dynamic information is continuously and automatically updated e.g., live room occupancy status from occupancy sensors and room booking data from the room booking system.
Location data (optional): Only if users choose to, Nimway applications can estimate the location of mobile devices indoors. Location data is used for wayfinding and sharing with colleagues. To protect the user’s privacy:
Office access data (optional): If the office access feature is enabled by the customer, Nimway stores the dates of which a user has office access bookings. Users can decide through a setting (disabled by default) if colleagues can see their upcoming bookings.
Parking reservation data (optional): If the parking reservation feature is enabled by the customer, Nimway stores the dates of which a user has parking reservations.
What employees can see: Nimway users can only access the names, email addresses, and profile photos of other users who have the same company email domain. In addition, users can access the indoor location of other users who have enabled the location sharing feature, but only if they are both at the office.
What office management can see: In the workplace analytics web interface, facility management teams can see building utilization data generated from the room booking system and sensors. Here, it is not possible to identify individual users. The optional features “office access” and “parking reservations” offer an optional secure API where the email addresses of users that have valid reservations can be accessed for integration with entrance access systems.
What the Nimway team at Sony can see: A limited group of people in the Nimway development team have access to customers’ personal data, in so far as they need it to develop and maintain the service.
Data collected by Nimway is retained only for a brief amount of time. Storage times for personal data are:
Nimway cloud is hosted on AWS (Amazon Web Services), under a Sony contract. The personal data is stored on S3, DynamoDB, and Postgres. Personal Identifiable Information (PII) is always encrypted at rest. Sony also uses AWS S3 checksums and encryption to ensure integrity for stored data and uses encrypted transfers. Sony is the controller of most personal information collected by Nimway unless otherwise specified in the contract with customer. Sony has a controller to processor agreement with Amazon because we use their servers to store information.
Our company—the Space Solutions Division within Sony Network Communications Europe—is ISO27001 certified for our information security infrastructure. Here are some of the things that helped us achieve this certification.
The Sony development process ensures that Nimway undergoes continuous security reviews and has automated source code analysis to prevent security degrades from being introduced in the production environment. On top of that, the Nimway service includes several security controls for personal data:
In addition, we’ve ensured that personal data can be removed entirely from Nimway. It is possible to have an entire user account deleted when signing out from the Nimway application. The AWS S3 mechanism ensures secure deletion from physical media. All backups of personal data will also have the same retention limits and be deleted automatically on a schedule.
As you can tell, the Nimway solution fully protects users’ right to not share location and other personal data with their employer or colleagues. In fact, our privacy standards go above and beyond industry regulations. If you want to monitor real-time office space utilization, offer seamless room booking, and create a modern workplace experience—all while building trust with your employees—let’s talk.
Copyright © 2021 Sony Network Communications Europe. All rights reserved