larssoni.com/for-it · 18 September 2026
To the person who has to approve us.
A colleague of yours wants to send a dashboard to people outside your company, and the tool they picked is mine. I built Larssoni and I answer the security questions myself.
You have five minutes, so here is what you would ask, in the order you would ask it.
What is it?
A hosted page. Your colleague made a dashboard with an AI tool, a single self-contained file, and we serve it at a link. We can keep its numbers current from a spreadsheet they control. Viewers open a link. Nothing is installed and no accounts are created for them.
Where does it run?
In a locked frame, on a domain that holds no logins. It cannot call a server, submit a form or open a window. Those are response headers, and the security page prints them.
How do our people get in?
If the link is locked, they type their work email and we send a six-digit code. It works once, for ten minutes. There are no passwords, so nothing to reuse and nothing for me to leak.
What does the owner learn about my people?
How many opened it. Never who.
How long do you keep their email?
Only as long as the dashboard exists, and never as an address: it is reduced to a keyed hash as soon as the code is sent.
What do you read, and what does the AI see?
One spreadsheet tab, on a schedule. The AI is used once, at set-up, and sees column names and masked digits, never real values. After that there is no AI in the loop.
Your spreadsheet
It stays in your Google account. Only Google’s hosts are contacted.
Larssoni
Checks the shape, swaps the numbers, publishes a new version. No AI in this step.
Set-up only: column names and masked digits
Anthropic
The locked frame
Draws the dashboard. Cannot call out, submit a form or open a window.
Your viewers
No account, nothing installed.
Where is it hosted, and who else touches it?
Cloudflare, with the database in Western Europe. Stripe for payments, Postmark for email, Anthropic for the set-up step. That is the whole list.
How do we leave?
One export, one delete button. You do not have to ask me.
What I can't offer you yet.
No single sign-on yet, no choice of data region, and the spreadsheet has to be viewable by link. If one of those is a hard requirement, I would rather you knew now.
What to allowlist.
Three names for browsers, one for mail. A dashboard cannot contact anything else: the frame does not allow it.
For the people opening dashboards
larssoni.comthe viewer pagelarssonipages.comdashboards on paid planslarssoni.codashboards on the free plan
Only if a dashboard uses them:
cdn.jsdelivr.netcdnjs.cloudflare.comunpkg.comfonts.googleapis.comfonts.gstatic.com
For your mail filter
hello@larssoni.comsign-in links and the codes that open locked dashboards, sent through Postmark.
A binding data processing agreement that takes effect with our terms, breach notice within 48 hours, 30 days' notice of any new sub-processor. Data processing terms
Send your questionnaire as it is: spreadsheet, PDF, portal link. I fill it in myself.
Oscar Wirén
Founder, Larssoni