Privacy policy – Bifrost Ledger

Core privacy principle

The service acts solely as a secure technical conduit between the customer's ERP system and Microsoft Excel, where the Bifrost Ledger Excel add-in displays it. Financial data remains within the customer's own systems and Microsoft Excel environment.

Data we process

Bifrost Ledger does not store or retain general ledger entries, accounting transactions, invoices, vouchers, payroll data, customer or supplier balances, or financial statements read from your ERP.

To operate the service securely and reliably, Bifrost Ledger processes limited technical and administrative data, including:

• Organization identifiers
• User identifiers
• License and subscription information
• Authentication metadata
• Configuration data
• Audit logs
• Journal entries your users post to the ERP through Bifrost Journal, with their posting history, so they can be audited

Technical metadata

During normal operation, the Service collects and processes limited technical metadata to deliver, secure, and improve the Service:

• Authentication data: email address, hashed password, and session tokens.
• Usage logs: timestamps, request types, and response status codes. These logs do not contain ERP data or financial information.
• ERP connection metadata: ERP type and connection status. ERP credentials are encrypted at rest.
• Billing data: billing address, VAT number, and payment method references as provided during checkout. Payment processing is handled by Stripe; Bifrost Ledger does not store credit card details.

All metadata is currently processed within the EU/EEA. No technical metadata is sold, shared for advertising purposes, or used for profiling.

Data handling

Bifrost Ledger acts as a secure conduit between your ERP system and the Bifrost Ledger Excel add-in in Microsoft Excel. Financial data passes through our servers but is not persisted. A batch's results are held in server memory for up to five minutes after the batch finishes, so the add-in can collect them, and the add-in keeps a result in memory for up to 30 seconds. Reference data used to build queries, such as the chart of accounts and dimension lists, is held in server memory for up to four hours, or five if the ERP cannot be reached to refresh it, and removed within ten minutes after that.

Audit logs recording which user accessed which data category (but not the data itself) are retained for up to 12 months for security and compliance purposes. Records of billing and bookkeeping decisions are kept as long as Norwegian accounting law requires.

Purpose and legal basis

Personal data is processed for the purpose of providing and securing the service, enforcing licensing terms, and fulfilling contractual and legal obligations. Processing is based on contract performance, legitimate interest, and applicable legal requirements.

GDPR compliance

Moralis AS processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Norwegian data protection legislation.

Depending on context, Bifrost Ledger acts as a data processor for customer-related technical metadata and as a data controller for account and operational data necessary to deliver the service.

Security

Bifrost Ledger applies appropriate technical and organizational security measures, including:

• Encryption in transit (TLS 1.2/1.3)
• Role-based access control
• IP restrictions where applicable
• Centralized audit logging

Cookies

Bifrost Ledger uses cookies to ensure the service functions correctly and to improve your experience. You can manage your preferences at any time via the cookie consent banner.

• Essential cookies — required for authentication, session management, and core functionality. These cannot be disabled.
• Functional cookies — store preferences such as your selected currency. Optional, enabled by default.
• Analytics cookies — help us understand how the product is used so we can improve it. Disabled by default and only set with your consent.
• Marketing cookies — used to measure the effectiveness of marketing efforts. Disabled by default and only set with your consent.

Specific cookies used: next-auth.session-token (essential, authentication), preferred_currency (functional, currency preference), cookie_consent (essential, stores your cookie preferences).

Data sharing and retention

Bifrost Ledger does not sell or trade customer data. Data may be processed by trusted service providers solely for service delivery purposes.

Data is retained only as long as necessary to meet contractual, legal, and security requirements.

Customer rights and contact

You may request access to, correction, deletion or restriction of your personal data, object to its processing, and receive it in a portable format. Requests can be sent to support@bifrostledger.com.

If you believe we process your personal data unlawfully, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or with the supervisory authority in your country.

This Privacy Policy may be updated periodically. The latest version will always be available on our website.