Data we process

Identity information provided by Microsoft Entra ID when you sign in: your name, email address, directory object identifier, and tenant identifier. Your organization and unit memberships and roles. Access requests you submit. Feedback you choose to send (ratings and comments) and any support requests you raise. Administrative and membership activity is recorded in an internal audit log for security and accountability.

Conversation history

Whether the Service keeps a copy of your conversations with an AI agent depends on your organization's settings. Where your organization has not enabled conversation history, messages are processed only within your organization's Microsoft Azure AI Foundry environment (together with any data sources configured for the relevant agent, under Microsoft's terms) and are not additionally retained by the Service.

Where your organization has enabled conversation history, the Service stores your conversations - including the names of any files you send to or receive from an agent, and, where your organization has additionally set up file storage for this purpose, the files themselves - in a database (and, for files, a separate storage account) dedicated to your organization, hosted in Microsoft Azure's Sweden Central region (EU/EEA). This content is encrypted at rest using a key unique to your organization, and your identity is pseudonymized within that database rather than stored in plain form. Stored conversations are kept until your organization disables this setting or a specific conversation is deleted; turning the setting off does not itself delete conversations already stored. Your organization administrator controls this setting.

As before, if you explicitly request support for a conversation, the transcript is separately shared with our support desk regardless of whether conversation history is otherwise enabled for your organization (see below).

In narrow emergency circumstances (for example, a security investigation or a legal obligation), specifically authorized Norian personnel can access a stored conversation through a separate, restricted procedure. This requires two independent approvals held by different people - a named access role, and separately, access to the encryption key for your organization - and every use of this procedure, successful or not, is logged with who accessed it, when, and the stated reason.

Support and feedback hand-off

The Service relies on Microsoft Azure for hosting, authentication (Microsoft Entra ID) and AI processing (Microsoft Azure AI Foundry), and on Zammad (norian.zammad.com) for handling feedback and support requests you submit. Both hand-offs happen only when you initiate them: a support request shares the conversation transcript with the support desk; feedback shares your rating and comment together with a conversation or message reference that authorized support staff can use to locate the conversation when following up. The Service is hosted in Microsoft Azure's Sweden Central region, within the EU/EEA.

Why we process it

To authenticate you, provide access to your organization's agents, operate the Service, and respond to feedback and support requests. The legal basis is the performance of the contract between ECIT Norian AS and your organization and our legitimate interest in running and securing the Service.

Retention

Identity and membership data are kept while your account is active within an organization. Audit records and feedback are retained until removed under the applicable retention policy. Where your organization has enabled conversation history, conversations are retained according to your organization's retention policy (which may set an automatic expiry), or until your organization disables the setting or a specific conversation is manually deleted. Support requests, including any conversation transcript you chose to share, are retained in NORIAN Assist (Zammad support desk system) according to its configuration.

Your rights

You may request access to, correction of, or deletion of your personal data. Contact your organization administrator or norianautomation@norian.eu. We will update this notice if our data practices change.

AI-generated responses

The agents in this Service use generative AI and can produce incorrect or misleading responses. See why this happens and what to do about it.

Contact

ECIT Norian AS (org. no. 879 906 792)
Stortingsgata 2, NO-0158 Oslo, Norway
norianautomation@norian.eu