# Nimbus for Knack

> A HIPAA security review for apps built on Knack. Nimbus reads a Knack app's structure, finds the mistakes that can expose patient data, and shows where each one is in the Knack builder. It runs from a chat with an AI assistant (through its MCP server) or on the website.

## What it is

Nimbus (https://nimbus.avvera.ca) is a paid tool from Avvera Technologies Inc. Knack handles the infrastructure of a HIPAA app (hosting, encryption, backups). Nimbus reviews how the app itself is built.

Nimbus is not affiliated with or endorsed by Knack. Knack is a trademark of its owner.

## What it looks for

- Public pages: pages with no login that show or change patient data
- Role access: who can view, add, edit and delete patient data, compared with what the owner wants each role to do
- Emails and tasks: patient data in email subjects and bodies
- Exports: patient data that can be downloaded, and by whom
- Exposed secrets: passwords and keys anyone can read in the app's structure
- App settings: logins, sessions, passwords and Data Access Control

Each finding names the page or view, how the role gets in and the change to make, with a link to that spot in the Knack builder and, where a HIPAA rule applies, a link to the regulation.

## What it does not do

- It never reads the records in a Knack app and never asks for the Knack API key
- It never changes the app. The owner makes every fix in the Knack builder
- It does not certify compliance. A clean result does not make an organization HIPAA compliant
- It flags custom JavaScript but does not analyze what the code does
- It cannot see Data Access Control's role-by-table grid yet, or other tools connected to the app

## How it works

1. Create an account at https://nimbus.avvera.ca (email or Google) and subscribe on the website.
2. Connect an AI assistant to the MCP server at https://nimbus.avvera.ca/api/mcp (OAuth). Claude and ChatGPT are supported. A good first prompt: "Help me get started with Nimbus for Knack".
3. Register the Knack app, and prove you control it by placing a short token in the app description or custom JavaScript.
4. Chat with the assistant about which fields hold patient data and what each role should be able to do. This usually takes 5 to 10 minutes.
5. Get the findings, fix them in the Knack builder, and ask for a refresh to see what's fixed and what's new.

Everything also works on the website, without an AI assistant.

## Pricing

- Monthly: $49 USD a month, no contract, 2 apps included, each extra app $15 a month

Prices are before tax. Paying happens on the website only, never in a chat. Details: https://nimbus.avvera.ca

## Links

- Website: https://nimbus.avvera.ca
- MCP server: https://nimbus.avvera.ca/api/mcp
- Terms of Service: https://nimbus.avvera.ca/terms
- Privacy Policy: https://nimbus.avvera.ca/privacy
- Support: support@avvera.ca
- Full audits of a HIPAA app and its connected tools, by Avvera: contact@avvera.ca