How Doc Lara handles your data.
This statement says, in plain terms, who is behind Doc Lara, where your data is kept, how AI processing works and what you can ask for before a pilot starts. Detailed architecture, data-flow and access-control documentation is available on request.
01Ownership and legal operator
Doc Lara is developed, owned and operated by Nextnor AS, a Norwegian engineering company registered in the Norwegian business register under organisation number 917 996 296.
For content placed in Doc Lara, the customer is the data controller and Nextnor AS acts as data processor under the customer agreement. Every document, project and message in your portal is yours.
02Your data stays your property
Doc Lara holds your documentation on your behalf — never as an asset of its own. Nothing in your portal is visible to, or shared with, any other customer.
At the end of a pilot or agreement your content can be exported to you and deleted from our systems on request.
03Servers and AI models in Europe
Servers and AI models are kept in Europe in accordance with the customer agreement.
For customers with stricter requirements, Doc Lara can be deployed on dedicated servers — isolated infrastructure for your organisation alone, with the hosting location fixed in writing.
04AI processing on commercial terms
Model calls run through commercial API agreements — not consumer chat services. Your content is processed to complete the task at hand and is not used to train AI models.
Doc Lara never trains or fine-tunes models on customer documents, and the AI models Doc Lara uses are kept separate from the large public consumer services.
05Access control and audit trail
Each company runs in its own private, access-controlled portal with named user accounts and administrator roles. Financial material is kept in a separate archive visible to administrators only.
Every action the assistant takes — filing, drafting, releasing, proposing a booking — is audit-logged with user, time and, for issued documents, a checksum of the exact file.
06People approve — always
Nothing is sent, booked, released or published without a named person approving it. Outbound e-mail leaves from the user’s own mailbox after a deliberate Send confirmation.
Original files are never modified: drawing markups live on separate overlays, and released document revisions are recorded and locked.
07This website
This website sets no cookies, runs no analytics and uses no tracking scripts. Visiting it sends no data to us. The only third-party request the pages make is to Google Fonts for typography.
All pages are served over HTTPS with a strict content-security policy. Contact and pilot requests are made by e-mail to ojr@nextnor.no.
08Responsible disclosure
If you believe you have found a security issue in Doc Lara or this website, please report it to ojr@nextnor.no. We acknowledge reports and keep the reporter informed until the issue is resolved.
Machine-readable contact details are published in /.well-known/security.txt (RFC 9116).
09What you can request before a pilot
Security documentation is shared with prospective pilot customers before any project data is loaded. On request we provide:
- Architecture overview and data-flow description
- Access-control and audit-logging model
- Hosting location and list of subprocessors for your deployment
- Draft data processing agreement and customer agreement terms
- Incident handling and data export / deletion procedure