NordivéSecurity and data processing
You handle confidential information. Here is the basis for assessing Nordivé: data flows, access, AI and the agreements behind the service.
Controls
What we store — and what we never store.
Email content is not stored by Nordivé. Results are stored in the firm’s own OneDrive.
No database of email, documents or case content — it is processed in memory and discarded.
Nothing is sent without your explicit approval.
Account and usage data is deleted within 30 days of the agreement ending, and logs after 90 days.
How the legal AI runs.
Terra and Sol in Azure OpenAI (EU data zone, Sweden) and Claude through AWS Bedrock (Ireland).
AWS Bedrock does not store requests or responses. Azure OpenAI processes them in the EU and may temporarily retain selected requests for abuse monitoring.
Your data is never used to train models.
All drafts are presented for review before use.
Where data resides and how it is protected.
Microsoft Azure, Norwegian data centre region.
No data transfers outside the EU/EEA.
All traffic over TLS 1.2+.
AES-256 for stored account and operational data.
Who can do what.
No new passwords — sign in with your existing account.
Two-factor authentication and conditional access are managed through your firm’s Microsoft 365.
Least privilege by default.
All access is personal and traceable.
GDPR, confidentiality and responsibility.
Signed before onboarding.
Nordivé is the data processor — you retain responsibility.
Designed around lawyers’ duty of confidentiality.
Built in line with industry requirements.
Monitoring, incidents and uptime.
Continuous infrastructure monitoring.
Defined procedures with notification within the stated timeframes.
Targets for availability and response times.
Nordivé is not ISO 27001 or SOC 2 certified. Provider certifications do not constitute certification of Nordivé. Independent certification is planned from 50 paying customers.
Data flow
Email, documents and case content are processed in memory. Account and operational data, such as usage counters and cost logs, are stored separately. Content you send to support may also be stored; avoid including client information.
Analysis results are stored in the firm’s own OneDrive. The technical documentation describes local storage, OneDrive, encryption keys and data flows in detail.
Email, documents and identity.
Workflow and processing. Backend in Azure Norway East.
Azure OpenAI in the EU data zone and AWS Bedrock in Ireland.
Nordwatch is a pilot connected to time tracking. When enabled, it reads screen text from selected work applications and permitted websites. Document titles, visible content and timestamps can provide a better basis for describing your work. The feature does not record audio.
Work memory is encrypted and stored locally, with a key protected by the operating system. History is automatically cleared after up to seven days or when the 250 MB storage limit is reached. Screenshots are used to read text and then discarded. On Mac, you can choose to retain screenshots; they are then stored encrypted on your device.
You can turn screen memory off in the sidebar. This stops new captures but does not delete existing history. History can be deleted separately or through automatic cleanup. Time entries already created are retained. Regular time tracking and the timer can still be used.
Not necessarily. Masking reduces exposure of names, contact details and identifiers, among other data, but does not guarantee anonymisation. Sensitive information may remain in the text. Descriptions you choose to add to a time entry follow Nordivé’s normal sync process.
AI suggestions should be based on observations. Check the description, matter and duration before use. Nordwatch does not know what you are thinking, and screen observations alone are not proof of billable time. The pilot provides no documented guarantee of greater accuracy. Summaries and more precise source views are not advertised here as available.
Providers
This overview is based on Nordivé’s published security documentation. The full list and contractual basis are reviewed before onboarding. Microsoft Azure, AWS and Microsoft Entra ID are covered by data processing agreements (DPAs). Terra and Sol run in Azure OpenAI’s EU data zone. Claude is used through Bedrock, which does not store requests.
| Provider | Role | Processing location |
|---|---|---|
| Microsoft Azure | Backend and infrastructure | Norway East |
| Microsoft Entra ID | Sign-in | EU |
| Microsoft Azure OpenAI | AI inference (Terra, Sol) | EU data zone (Sweden) |
| AWS Bedrock | AI inference (Claude) | Ireland |
| Vercel | Website and web application hosting | European nodes |
| Anthropic / Claude | AI model through Bedrock | EU through AWS |
Documentation
Questions and answers
Email content is not stored by us, and AI providers do not use it for training. Results are stored in your firm’s own OneDrive. We sign a data processing agreement under GDPR Article 28 before onboarding, and you remain the data controller throughout.
The entire backend runs in Norway East (Microsoft Azure). AI inference takes place in Azure OpenAI’s EU data zone (resource in Sweden) and AWS Bedrock in Ireland. Nothing leaves the EU/EEA, and email content is not stored by us.
No. We have no database of email, documents or case content — it is processed in memory and discarded. We store operational data: usage counters, a cost log per AI request, the access list, support threads you initiate, encrypted sign-in keys if you enable background analysis, and call data (numbers and durations) for 90 days if your firm connects its telephone system. Support is the one place client content may end up, because you can paste an email or attach a document to show us an issue. We ask you not to, but cannot prevent it, and we say so rather than promising it cannot happen.
No. Your data is never used to train models, by us, Microsoft or AWS.
Terra and Sol run in Azure OpenAI’s EU data zone (resource in Sweden). Claude runs through AWS Bedrock in Ireland. AWS Bedrock does not store requests or responses, and Microsoft processes them in the EU.
Yes. All traffic is encrypted in transit (TLS 1.2+), and stored account and operational data is encrypted at rest (AES-256).
Through Microsoft SSO (Entra ID), with MFA under your firm’s own rules — no new passwords, and all access is personal and traceable.
Access is role-based under the principle of least privilege. There are no shared accounts, and no one receives access to client content without a genuine need.
Yes. A data processing agreement under GDPR Article 28 is signed before onboarding.
You are. Nordivé is the data processor; you retain responsibility for personal data throughout processing.
No. The backend (Norway East) and AI inference (Azure OpenAI in the EU data zone and AWS Bedrock in Ireland) are within the EU/EEA. No transfers outside the EU/EEA.
Get to know Nordivé
See how time tracking and email can fit
into your working day. We will show you the product.