Privacy

What Nordsynk stores and why

Nordsynk authenticates MCP sessions and operates Fortnox workflows. Some workflows also store company data, bank data, change details, uploaded files, and operational information to provide the service. This notice describes the main purposes and known storage windows; periods vary by data type.

Provider: Nordbeam AB, reg. no. 559434-4201, Limhamn, Sweden
Last updated: October 18, 2026

This notice is published in Swedish and English. Where the two differ, the Swedish text governs.

Identity and account data

Nordsynk stores the internal Nordsynk user id, the connected Fortnox company's id, company name, organization number, last login timestamp, and when available the Fortnox-linked email address and Fortnox user identifier.

Session data

Nordsynk uses encrypted browser cookies to keep you signed in across the admin pages and the pages where you connect an AI assistant, on `nordsynk.se` and `mcp.nordsynk.se`. Those cookies contain the Nordsynk user id, the connected Fortnox company's id, company name, and the approved Fortnox integration scopes needed to reuse the session safely. A separate server-side record stores a session identifier, issue and expiry times, and revocation status so Nordsynk can validate the session. Sessions expire within 30 days; expiry or revocation ends access. Expired records are removed in bounded batches when new sessions are issued. Revocation does not erase a record immediately.

Licensing and company connection state

For the Fortnox Marketplace rollout, Nordsynk caches company connection records and Fortnox seat-verification results so the service can decide whether a user should be allowed to connect.

Operational telemetry

Nordsynk records limited operational events such as OAuth activity, MCP tool names, durations, and success or failure state in its first-party Cloudflare telemetry stores. A strictly filtered, pseudonymous subset is mirrored to PostHog EU Cloud for product learning. Raw Fortnox records, company names, organization numbers, email addresses, free-form messages, OAuth material, and approval payloads are not included in that mirror.

Cookies, site analytics and ad measurement

Nordsynk uses Google Analytics 4 (measurement ID G-Y1VLVFJWVP) and PostHog EU Cloud to understand how the site and onboarding are used. Analytics storage is denied by default and PostHog does not start until you click Allow cookies. Before acceptance, Google receives only aggregated, cookieless Consent Mode pings without identifiers. After acceptance, PostHog records intentional product events and may record fully masked sessions on marketing and onboarding pages: all visible text, form inputs, and element attributes are masked, and dashboard, agency, operations, authentication callback, and approval pages are excluded. Raw accounting data is never included. Google Analytics events are retained for 14 months and processed by Google LLC in the United States under the EU Standard Contractual Clauses; PostHog data is processed in the EU. After acceptance we also load the Meta Pixel from Meta Platforms Ireland Ltd. It runs only on public pages, never on signed-in pages or approval links. The pixel sends the page address, your IP address and browser details to Meta and stores a browser ID in the _fbp cookie, so we can show our ads on Facebook and Instagram to people who have visited the site. If you came through a Google or Meta ad, we also keep the ad's click ID in a cookie (ns_ad_click) for 90 days. If your company then activates Nordsynk in Fortnox, we send the time to the ad platform together with the IDs we have: the click ID to Google Ads (Google LLC), and the click ID, the browser ID and which browser you use (the user agent) to Meta, so the activation can be counted. Names, email addresses, organisation numbers, IP addresses and accounting data are never sent with the activation. We delete the click ID, browser ID and browser details on our side after 90 days. You can change your choice at any time via “Manage cookies” in the footer.

Video guides from YouTube

Our video guides are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing loads from YouTube until you press play. When you do, the player loads from YouTube, which is run by Google. YouTube then receives your IP address and details about the playback, among other things, and may store data in your browser. Google's privacy policy applies to that processing.

Support chat

If you message us through the support chat, we store the message, the page it was sent from, and the email address you provide. The message is also sent to our Slack channel so the team can follow the conversation and reply directly. When AI replies are enabled, message text is sent to Google's Gemini API to generate a response. Slack and AI replies are shown in the chat.

The demo environment (demo.nordsynk.se)

At demo.nordsynk.se you try Nordsynk on a fictional company, Nordsynk Demobolag AB, with generated accounting data. No Fortnox login and no real company data are involved. You sign in with an email address that we do not verify and never email. We store the email address, a user account with the demo company attached to it, the sign-in session, the time of your last sign-in and operational telemetry about the calls your AI assistant makes in the demo. To stop abuse we count sign-ins per IP address and email address for 15 minutes, stored as hashes. Changes you approve in the demo company are kept for your account only and deleted seven days after the first change. The demo environment has its own database and shares no data with Nordsynk's production environment. The AI assistant you connect to the demo receives the fictional data it reads. To have your demo account deleted, email hello@nordbeam.io.

Marketing and ad audiences

To reach companies similar to our customers, we may normalize and hash customer email addresses before sending the hash to advertising platforms such as Meta and Google. Hashing reduces direct exposure, but the hash remains personal data and is used for audience matching, measurement, suppression, and related advertising purposes described here. The legal basis is our legitimate interest in marketing the service; you can object at any time by emailing hello@nordbeam.io and we will exclude your address from future audiences.

Fortnox data access

Fortnox data is accessed through authenticated MCP sessions and Fortnox-issued OAuth tokens. Each user connects with their own Fortnox account, and access remains subject to that user's company permissions, product licenses, Nordsynk seat, and the approved integration scopes. Selected workflows store protected SIE/ledger snapshots for reports and DataLink exports, plus change-request details and replay data used to show a preview, record a decision, and execute the requested change. By default, changes open a browser approval preview; a company can enable auto-approve in Nordsynk Dashboard → Settings → Change approval. Fortnox permissions and the company's Nordsynk access policy apply in either mode.

Bank data through open banking

If bank connections are enabled for a company, Nordsynk can use Enable Banking Oy, a Finnish account information service provider (AISP) supervised by FIN-FSA, to read selected Swedish bank accounts, balances, and transactions. Returned details can include dates, amounts, currencies, counterparties, references, and remittance text when the bank provides them. The connection is read-only and cannot initiate payments. Detailed bank sessions and transaction history are stored in Nordsynk's bank ledger with an explicit EU jurisdiction. A separate D1 database stores connection and account summaries, including a masked account identifier and latest balance, but not transaction rows; it has no explicit geographic pin. People with access to the company in Nordsynk can read this data, including accounting-firm consultants with access to the client company in their workspace. When you ask your AI assistant for bank data, it is returned to the connected AI client and handled by that provider under your agreement. Enable Banking states that it is also a data controller for the regulated AISP service; the role allocation requires legal review.

Bank consent and deletion

Consent lasts until the date shown by the bank. You can review or revoke it on Enable Banking's data-sharing consent page. When consent expires or is revoked, further fetching stops once the change is detected, but bank history already fetched is not deleted immediately. If the feature is enabled for your company, connect, account mapping, refresh, status, and disconnect are available in Dashboard → Bank. Offboarding and qualifying consent-expiry markers become eligible for scheduled purge after a 30-day grace period; failures are retried, so this is not a guaranteed deletion deadline. To request access, correction, or deletion of bank data held by Nordsynk, email hello@nordbeam.io. Limited audit metadata or backups may remain under separate retention rules.

Dropzone — temporary file storage

When you send a file, such as a receipt or invoice PDF, to Fortnox through your AI assistant, it is staged briefly in private Nordsynk storage. No file is published at a public URL. The upload link is valid for 30 minutes by default (5–60 minutes), and you can ask the assistant to revoke a pending upload session. Staged bytes are normally deleted once Fortnox has received the file, with a 24-hour cleanup backstop; rejected files, such as the wrong file type or an invalid PDF, are not retained.

Nordsynk Supplier invoices

This section applies to companies that use Nordsynk Supplier invoices. Invoices sent to the company's address at nordsynkfaktura.com, or uploaded, are stored in Cloudflare R2 in the EU. From each email Nordsynk keeps the sender address, the subject line and the message itself with its attachments. To read an invoice and suggest how to book it, Nordsynk sends the document to Anthropic (Claude), which processes it in the United States and does not use it to train its models. Nordsynk keeps the details read from the invoice, the coding, decisions and comments, and the names and email addresses of the approvers the company adds. The original file and the email are deleted 30 days after the invoice is registered in Fortnox or rejected. The PDF stays in Fortnox. For invoice data, Nordbeam AB is the processor and the company is the controller.

Expenses: receipts and documents

This section applies to companies that use Nordsynk Expenses. Receipts and other documents sent to the personal email address, to the company's card address, or uploaded in the app are stored in Cloudflare R2 in the EU. For emails, Nordsynk keeps the sender address, the subject line and the message with its attachments. To read a receipt, the image or PDF is sent to Anthropic (Claude), which processes it in the United States and does not use it to train its models. When a receipt has no category, Nordsynk first chooses one from the company's earlier receipts from the same merchant and from how the merchant has been booked in Fortnox. For this, about once a day Nordsynk reads the company's vouchers for its two latest financial years and keeps, for each merchant, only a simplified form of the name and how many vouchers were booked to each category. Voucher texts, amounts and payroll vouchers are not kept. When that is not enough, details such as the merchant, amount, VAT rates, receipt lines and any stated purpose are sent to TypeSafe (the Jev AI model) to choose a category. TypeSafe processes the data in the United States and does not use it to train models. The image or PDF is not sent there. From the receipt Nordsynk keeps details such as merchant, date, amount, currency, VAT, account, category, purpose and attendees, and who submitted and who authorized it. The names and email addresses of the authorizers the company adds, and of the people who submit expenses, are also kept.

Expenses: card purchases and bank data

Administrators can send or upload the company's card statements (PDF, image or CSV). The statement lines are stored as card purchases and matched to receipts. We do not store bank account numbers. For cards only the last four digits are kept, so that purchases can be matched to the right person. If the company has connected its bank account, Nordsynk reads, through Enable Banking Oy, only debits that look like card purchases and only on the accounts the administrator has chosen. Enable Banking Oy is a Finnish account information service provider supervised by FIN-FSA. Card purchases are shown to the cardholder and to administrators. Private purchases on company cards show only the amount and merchant, and only to administrators. Authorizers see only the items sent to them.

Expenses: mileage, per diem and payroll

Mileage allowances and per diem are calculated under Skatteverket's rules for the year and sent to Fortnox Payroll, or exported as a basis for another payroll system. To do this, Nordsynk reads from Fortnox only the name, email address, employee number and whether the employee is inactive. Other fields are dropped immediately and not stored. Personal identity numbers and bank account numbers are never stored. Bank details for paying out private expenses through a supplier invoice are passed straight to Fortnox when the supplier is created and are not stored in Nordsynk.

Expenses: retention periods

The original receipt and the email are deleted 30 days after the expense has been booked in Fortnox. The PDF of the receipt stays in Fortnox. The original receipt, the email and the files are also deleted 30 days after the expense is rejected or withdrawn. Duplicates and documents that are not receipts are deleted the same way. Items that have failed keep their files until the case is resolved. Card purchases are kept for 400 days after import. Details of the expense and a log of who did what stay in Nordsynk for as long as the company is active. Backups and Cloudflare's database time travel are deleted under their own retention periods; application cleanup does not delete them immediately.

Expenses: controller and processor

For receipts, card purchases and payroll data that Nordsynk processes on the company's behalf, Nordbeam AB is the processor and the company is the controller. Anthropic is used as a sub-processor to read receipts and card statements, and TypeSafe (Jev) to choose a category for receipts. Enable Banking Oy is used for bank data when the bank connection is enabled. The role split for bank data follows what is described under Bank data above.

Reports: bookkeeping data

This section applies to companies that use Nordsynk Reports. Every night Reports reads the bookkeeping in Fortnox: the SIE export for the current and previous financial year, and open customer and supplier invoices. Reports never writes to Fortnox. Its Fortnox client can only read; it has no calls that create, change or delete anything in Fortnox. The Fortnox consent, however, covers more permissions than reading, because Fortnox does not split its permissions. Reports has its own Fortnox connection and its own tokens. It does not affect Nordsynk's MCP permissions and does not give any licence. Aggregated results are stored in Nordsynk's database. SIE files and report PDFs are stored in Cloudflare R2 within the EU. The two most recent SIE files per financial year are kept; older ones are removed after the next successful sync. Monthly reports with ratios, commentary and forecast are kept as an archive while the company is active. For bookkeeping data, Nordbeam AB is the processor and the company is the controller.

Reports: bank data

If the company has connected its bank account, Reports uses account balances through Enable Banking Oy, only for the accounts the administrator chooses. Reports uses the bank balance together with the booked balance of the bank accounts in the bookkeeping for the cash forecast, but does not show the transaction list. The connection is read-only.

Reports: commentary written by AI

Each monthly report gets a draft commentary written by AI (Claude from Anthropic). The AI receives only the computed figures, their sources, and the voucher text of the largest vouchers in the month, not access to the rest of the bookkeeping. The reply is checked against the figures, and a person can edit the commentary before the report is sent. Anthropic processes the data in the United States and does not use it to train its models. Anthropic is a sub-processor for the commentary.

Reports: recipients and links

The report is sent by email to the recipients the company chooses. Recipients can be people outside the company, such as board members or the accounting firm. Each recipient gets their own link, valid for 90 days, which shows only the saved report, not live data. Nordsynk stores the recipient's name, email address and role, when the email was sent, when the report was first opened, and how many times it has been opened. The company can remove a recipient at any time. The links are not searchable.

Reports: retention periods

If the subscription is cancelled, or the trial ends without payment, the company's Reports data, including reports, PDFs and SIE files, is deleted 60 days later. The PDFs and SIE files are stored in Cloudflare R2 within the EU and are deleted in the same step. The event log is kept for 12 months for audit. The same period applies when the company disconnects from Fortnox. If the company reactivates before the period ends, the deletion is cancelled. Links that have already been sent work until their expiry date.

Controller and processor roles

For the account data, session data, operational telemetry, and marketing data described above, Nordbeam AB is the data controller. For bookkeeping and customer data that Nordsynk reads or writes in a customer's Fortnox company on the customer's instructions, Nordbeam AB instead acts as a data processor, and the customer remains the controller for that data. The roles for bank data among Nordbeam AB, Enable Banking Oy, the bank, and the customer require review for each processing purpose. Enable Banking states that it is the data controller for its regulated AISP service.

Data processing agreement (DPA)

A data processing agreement covering how Nordbeam AB handles a customer's bookkeeping data in Fortnox on the customer's instructions is available on request at hello@nordbeam.io. That agreement does not establish the terms for Enable Banking's regulated AISP service. Enable Banking states that it is the data controller for that service. Contact hello@nordbeam.io for the current terms and role allocation that apply to a particular bank-data processing purpose.

Sub-processors and bank data provider

Nordsynk uses Cloudflare (hosting, database, file storage, and email delivery), Google (the Gemini API for website support chat and Google Analytics 4), and PostHog EU Cloud (product analytics). Anthropic (Claude API) reads documents for Nordsynk Supplier invoices and Expenses and drafts commentary for Reports. Anthropic processes the data in the United States; transfers are made under the EU standard contractual clauses in Anthropic's data processing addendum (DPA), and API content is not used to train models. TypeSafe (the Jev AI model) chooses a category for receipts in Expenses; it processes the data in the United States and does not use it to train models. Firm agreements also use Stripe (billing). When bank connections are enabled, Nordsynk uses Enable Banking Oy, Finland, as its regulated account information service provider. Enable Banking is a Finnish AISP supervised by FIN-FSA; its role and terms for bank access are described in the bank-data section. Fortnox, Spiris, and Bokio are accounting systems the customer chooses to connect.

Retention periods

Storage periods vary by workflow and data type. A protected SIE/ledger snapshot becomes stale after six hours; that is a freshness threshold, not a deletion deadline. Scheduled cleanup removes snapshots after 30 days without successful use. Revoking or expiring a DataLink ends access through the link but does not set a separate deletion date for its source snapshot. Change approvals retain a masked preview and decision and outcome details. New exact requests needed to execute or resume a change are encrypted at rest; scheduled cleanup clears them 30 days after a resolved execution, sooner for declined requests. Unresolved or safely retryable requests retain their replay copy until their lifecycle is settled. Older plaintext requests are migrated in bounded batches. This notice does not state a fixed deletion period for approval audit rows. Application cleanup does not immediately erase D1 Time Travel or backup history. Google Analytics events are kept for 14 months (see "Cookies and website analytics" above). Dropzone file bytes are deleted after successful ingest, expiry, or revoke, with a 24-hour cleanup backstop — see the Dropzone section below. Related file and event metadata may remain after the bytes are deleted; this notice does not state a fixed deletion period for that metadata.

Privacy contact and updates

Nordsynk is provided by Nordbeam AB (org. no. 559434-4201), Nätsnäcksgränd 8, 216 31 Limhamn, Sweden. Questions, access requests, correction requests, or deletion requests can be sent to hello@nordbeam.io. This notice may be updated when the service, Fortnox requirements, or supported MCP clients change.