Nimbus runs entirely locally. Your Apex source, your test data, your schema - none of it leaves your machine. This page explains exactly what Nimbus does and doesn't do with your data.
Nimbus reads your .cls, .trigger, and .flow-meta.xml files locally. No source is transmitted anywhere - not to Nimbus servers, not to Salesforce, not to any third party.
Records inserted during tests live in an embedded PostgreSQL instance on your local disk. The database runs in-process - it has no network port open. Nothing persists between test runs (each test runs in a rolled-back transaction).
Object definitions are read from your sfdx-project.json and .object-meta.xml files. No schema is fetched from a Salesforce org - Nimbus works entirely from source.
The Apex interpreter runs as a subprocess on your machine. No code is sent to a remote execution environment. Results are computed locally and displayed in your terminal or editor.
Nimbus records one privacy-minimal activation event by default. Licensed headless CI records a separate, de-duplicated event so repeated builds do not inflate human installation counts. No source code, file paths, test names, record data, repository, branch, workflow, or command arguments are ever included.
Telemetry is aggregated and used only to understand which features are used and which error patterns to prioritize. It is not sold, shared, or used for advertising.
You can opt out at any time:
# Disable telemetry permanently
nimbus config set telemetry=false
# Or set in nimbus.properties
# nimbus.telemetry=false
# Or via environment variable
# NIMBUS_TELEMETRY=false nimbus test
# Verify telemetry status
nimbus config get telemetryPro and Team licenses are validated via a lightweight request to the Nimbus licensing API on first activation and periodically thereafter. The request contains only your license key and a machine identifier.
The machine identifier is a one-way hash of your hostname - it cannot be reversed to identify your machine and is used only to enforce seat limits. No other data is sent.
Free tier requires no network access at all. Licenses are cached locally and validated offline for up to 7 days, so Nimbus works without internet access for normal use.
# Sign in via browser and activate this machine
nimbus login
# What's sent to the licensing API (Keygen):
# {
# "key": "NIMBUS-XXXX-XXXX-XXXX", ← retrieved by your authenticated browser session
# "machine": "sha256:a3f8b2..." ← one-way hash of host + OS + user
# }
# What's NOT sent:
# - File paths, project names, or source code
# - Test output, coverage data, or Salesforce data
# - Anything from your codebase or org
# The browser handshake authenticates you to the portal (Supabase) so we
# can hand the right license key to your CLI — that part never touches
# Keygen with your name attached.Nimbus supports fully air-gapped installation. The binary and embedded database engine can be distributed via internal artifact repositories without internet access.
For Team tier customers, on-premise license validation is available - no outbound network required for license checks. Contact us to discuss your deployment requirements.
# Air-gapped install: copy binary directly
cp nimbus /usr/local/bin/nimbus
# Pre-seed the embedded database engine
# (downloaded once, then cached)
nimbus init --cache-dir /opt/nimbus-cache
# Disable all network access
# nimbus.telemetry=false
# nimbus.update-check=falseIf you have specific security requirements or need documentation for an enterprise procurement review, reach out directly.