What Larssoni is, in one page.
A colleague wants to share a dashboard with people outside your tenant. Here’s exactly what that means for you.
What it is: hosted display of a static dashboard your colleague made, with scheduled data refresh from a spreadsheet they control. Viewers open a link — no accounts created, no software installed, nothing executes outside a sandboxed iframe with a restrictive CSP set in response headers.
Domains to allowlist
| Domain | Role |
|---|---|
| larssoni.com | App + viewer page chrome (accounts live here; your viewers don’t need one) |
| larssonipages.com | Dashboard display for business plans — cookie-free, locked CSP (no external connect-src, form-action ‘none’, sandboxed) |
| larssoni.co | Free-tier public display — separate domain by design, so business content never shares its reputation |
Data flow
Structure-only default: AI-assisted setup reads column names, not values. Real values flow only at refresh, validated deterministically — no model in the refresh path.
Access control: links can be public, allow-listed by email, or gated to your email domain — enforced server-side before any content token is issued. Viewer access is revocable. Owners see how many people opened a dashboard — never who: verifying emails are reduced to an irreversible per-dashboard hash and are never shown to the owner.
Paperwork: a binding Article 28 data processing agreement (self-executing — no signature chase) · named sub-processor list with 30 days’ notice of changes and a right to object · UK Extension to the EU-US Data Privacy Framework for US transfers · 48-hour breach notification · coordinated disclosure policy. Questions: support@larssoni.com.