Privacy Policy

Who is responsible

The party responsible for the account, session and log data processed in nexora is:

Sydoc AG
Mühlegasse 18
6340 Baar, Switzerland
Company ID (UID): CHE-112.467.492

Please send data-protection questions to support.helpdesk@sydoc.ch.

nexora is part of the services Sydoc provides to its clients and is not offered separately. The business documents and entries you see in nexora belong to the organisation you work for. Sydoc processes them on that organisation's behalf under a data-processing agreement. In some cases nexora runs in the client's own environment without Sydoc having access to it.

What nexora stores about you

• Account details: name, username, e-mail address, organisation, language and display preferences, the time of your last sign-in and, if you upload one, a profile picture.
• Sign-in security: a password hash, a secret for two-factor sign-in, which applies to every account, and the number of failed sign-in attempts together with any temporary lock.
• Active sessions: a session identifier, your IP address, and the times of sign-in and last use.
• Request log: for each page or API call, the address with its parameters, the method, the response code and the duration, your IP address, the session identifier and the account that made it, timed to the hour. Search terms and searched field values are not stored.
• Feedback and requests: messages and attachments you send through the feedback form or the request form, together with your name, username, e-mail address and organisation, go to Sydoc's helpdesk as a ticket (if that is not possible, by e-mail to Sydoc's support).
• Reporting assistant: if you use it, your questions, its answers and the queries it builds from them, logged for traceability.
• Business documents, their index fields and entries such as reports or hours, on behalf of the organisation whose data they are.

Sensitive data

The business documents processed through nexora may contain sensitive personal data, for insurers for example health information in applications, health questionnaires or medical records. Sydoc processes such data only on behalf of the organisation it belongs to, and only for the purpose that organisation entrusted it to Sydoc for. It is not used for any other purpose. The documents are stored on Sydoc's own servers in Switzerland. Only people who hold the permission for it and have signed in with two factors have access; fields marked as sensitive are shown only to accounts with an additional permission. The people who appear in these documents are informed by the organisation concerned, which is responsible for them.

Why it is stored

Account details let you in and show nexora in your language. The password hash and the two-factor secret make sure it is you signing in; counting failed attempts protects your account against someone guessing your password. Session data keeps you signed in between requests and shows an administrator which sessions are active. The request log is used to trace faults and to detect misuse of an account. Feedback messages are used to handle your question or report. The reporting assistant's log makes it possible to trace which queries the assistant ran for whom. Business documents are processed to deliver the service your organisation obtains from Sydoc.

How long it is kept

• Request log: 180 days, then deleted automatically.
• Session data including the IP address: 8 days, then deleted automatically.
• Accounts, including profile picture, last sign-in and sign-in lock: until your organisation asks for them to be deleted. Accounts are currently not deleted automatically, because your organisation manages them and they are part of billing.
• Feedback and requests: the helpdesk ticket is deleted once your request has been dealt with. If a message goes to support by e-mail instead, that e-mail is deleted after 12 months.
• Reporting assistant log: 180 days, then deleted automatically.
• Business documents and entries: for the term of the contract between Sydoc and your organisation. Within 30 days after the contract ends they are deleted or returned to the organisation, unless the contract provides otherwise or the law requires them to be kept.
• Backups: Sydoc backs up its databases regularly. Backups are overwritten on a rolling basis and kept only as long as needed to restore operations; deleted data disappears from them at the latest then. Backups are protected like the data itself.

Who receives it

• Microsoft: parts of nexora run on Microsoft Azure in the Switzerland region, and e-mails such as scheduled reports are sent through Microsoft 365.
• ngrok, Inc. (USA): nexora is reachable from the internet through a service by ngrok. Traffic passes through ngrok's servers, including in the USA. There is a contract with ngrok.
• When a page loads, your browser fetches fonts from Google Fonts (Google, USA) and program files from cdnjs (Cloudflare, USA) and jsDelivr. These providers receive your IP address in the process.
• Anthropic PBC (USA): the reporting assistant uses Anthropic's AI model Claude (Sonnet) to turn a question into a report or a query and to describe results in a sentence. For that, your question and the structure of the databases it may read, meaning table and column names, go to Anthropic. Data rows from reports are only sent for the few accounts that hold a special permission for it.
• Atlassian (Australia and USA): Sydoc's helpdesk runs on Atlassian Jira Service Management. Feedback and requests you send from nexora are stored there as tickets, together with your name, e-mail address and attachments. Atlassian stores the data in its own data centres, which may be outside Switzerland.

For the transfers to the USA, Sydoc relies on the following: Google, Cloudflare and ngrok are certified under the Swiss-U.S. Data Privacy Framework, which Switzerland recognises as providing adequate protection. For Anthropic and jsDelivr, standard contractual clauses in their data-processing agreements apply. Atlassian is also certified under the Swiss-U.S. Data Privacy Framework; for storage locations in other countries, the standard contractual clauses in Atlassian's data-processing agreement apply.

Should people in the EU use nexora in future, the rights under the General Data Protection Regulation apply to them as well; the details are set out in the data-processing agreement with the organisation concerned.

Cookies and browser storage

nexora sets a single cookie. It keeps you signed in between requests and protects forms against being submitted from other websites, which is why it is also set when you are not signed in, for example while reading this page. It is necessary for the service, cannot be read by scripts and expires after 24 hours at the latest. Your browser also stores your settings, for example light or dark mode, whether the sidebar is pinned or which tab was open last. These settings do not leave your browser. nexora uses no cookies for advertising or for analysing your behaviour.

Your rights

You can ask which data about you is processed, and ask for it to be corrected or deleted. Write to support.helpdesk@sydoc.ch. We answer requests for information within 30 days and check your identity before disclosing anything. Where the data belongs to your organisation, we pass the request on to them, because they decide.

You can also complain to the Federal Data Protection and Information Commissioner (FDPIC).

Changes

If this policy changes, the new version is published on this page and the "last updated" date above is changed. Material changes are announced beforehand in nexora under \"What's New\".