A governed connection
Connect your AI. Keep your systems as the source.
Fjordova is designed to retrieve the information needed from your connected business systems and pass it to your chosen AI — without building a permanent copy of your accounting data.
Your systems remain authoritative.
Original business records remain in the systems you already use.
Access follows permissions.
The connection is governed by the access granted to it.
Changes are proposals first.
Preview → confirmation under company settings → execution → result. Changes require company enablement and AI write access. Choose AI app confirmation or own-page confirmation for irreversible or all changes in My account.
Illustrative data flow
Your chosen AI
Example
- 1Check permissions
- 2Retrieve requested information
- 3Forward the result
Your business systems
Original records remain at the source.
Your selected AI receives the information under your separate agreement with that provider.
Connection and security records
The audit log is content-free; temporary encrypted proposals and results are not and can contain sensitive business and personal data. They are not a separate accounting archive.
You ask a question in your AI tool.
Reads pass through working memory and to your selected AI; there is no separate accounting, payroll or document archive. Change input, previews and execution results are temporarily stored encrypted and may contain financial, payroll, document and sensitive personal data. Code can decrypt them to perform the task. Encryption is not anonymisation or proof that technical access is impossible. Company and identity records can include encrypted email and company details.
Data handling
What is handled where
The following storage, retention and infrastructure details describe the Fjordova MCP service. Website-form registrations are handled separately; see the website-form privacy notice.
| Category | How it is handled |
|---|---|
| Customer-system reads | Requested information passes through working memory to your chosen AI under your separate provider agreement. No separate accounting, payroll or document archive is built. Original records remain in the source; confirmed writes intentionally change them there. |
| Connection and identity records | Records can include encrypted email and company details. Fortnox tokens are deleted immediately when that user’s last AI app is revoked on the account page; this does not revoke other users’ connections. Otherwise deletion is within one day after access ends and at most 15 days after last use. |
| AI access and registration | An AI access token is valid for at most one hour. Authorisation lasts at most 30 days and expires after 14 days of inactivity. App registration lasts 90 days, renewed while used; a never-used registration is removed after 24 hours. |
| Encrypted changes | Change input, previews and execution results are temporarily stored encrypted and may contain financial, payroll, document and sensitive personal data. Code can decrypt them for the task; encryption is not anonymisation or proof that technical access is impossible. Proposals are valid for at most 5 minutes, or 15 minutes with own-page confirmation. Input and preview are cleared when execution is claimed; an encrypted result may remain until cleanup. The full proposal is normally purged no later than 25 hours after final validity expiry and on company deletion, subject to unresolved-write handling. |
| Uncertain outcomes | Content is cleared by the normal deadline. A content-free technical reservation may remain until the outcome is resolved. An uncertain write is not automatically repeated. Active or unresolved writes can delay company deletion pending clarification. |
| Customer audit log | IDs, tool, outcome and time — never questions, answers or Fortnox content. Kept 395 days per event during the agreement, including after user removal. Deleted with the company, subject to residual-event cleanup. |
| Fjordova administration log | Separate IDs, action and time records are kept 395 days, including after company deletion, with special handling for an ongoing emergency stop. Not all logs disappear on company deletion. |
| Recovery history | Deleted data can remain in recovery history for up to 30 days. |
| Support cases | Kept 24 months after closure. Do not email financial or payroll contents, documents or sensitive personal data to support. |
| Public-source responses | Public-source responses can be cached for up to seven days, unlike customer-system reads. Do not include personal data in public-data search terms. |
| Production diagnostics | The v1.2 policy states that Workers Logs are disabled in production. |
| AI-side handling | The selected AI receives the information under the customer’s separate provider agreement. Fjordova’s retention policy does not determine the AI provider’s policies. |
Questions
Common questions
Does information pass through Fjordova?
Yes. In the documented design, Fjordova retrieves and processes the requested information before returning it to the chosen AI.
Does Fjordova keep my entire accounting database?
The design is intended to avoid a permanent accounting-data store in Fjordova. Connection, security and temporary approval records are separate categories.
What happens before a change is made?
Changes are proposals first. Preview → confirmation under company settings → execution → result. Changes require company enablement and AI write access. Choose AI app confirmation or own-page confirmation for irreversible or all changes in My account.
Changes are proposals first: preview → confirmation under company settings → execution → result. The company must enable changes, and the AI connection needs write access. In My account, choose AI app confirmation, own-page confirmation for irreversible changes, or own-page confirmation for every change. In AI app mode, Fjordova verifies the technical confirmation call, not what was said in the chat.
The service terms, privacy policy and data processing agreement (version 1.2, in Swedish; including subprocessors, retention periods and incident notification) are available at: villkor · integritetspolicy · personuppgiftsbitradesavtal
Hosted on Cloudflare with D1 and Durable Objects configured with EU jurisdiction. This is not a promise of EU-only processing: computation, technical processing, support and subprocessors can involve countries outside the EU/EEA. Subprocessors include Cloudflare and Google Cloud EMEA Limited (support/mail); see the data processing agreement for safeguards. Per-company envelope encryption protects stored tokens and change records. Administrators have an emergency stop and can disable changes. Security reports: support@fjordova.com. Do not include financial or payroll contents, documents or sensitive personal data.
Data processing agreement — safeguards and subprocessors