Business NXT documentation

Home
System administration
This is where you find important information about configuring and monitoring Business NXT, for example about setting up user permissions and roles, and about the system logs.
General Data Protection Regulation (GDPR)
The EU General Data Protection Regulation (GDPR) replaced the Data Protection Directive 95/46/EC and was designed to harmonise data privacy laws across Europe, to protect and empower all EU citizens' data privacy and to reshape the way organisations across the region approach data privacy. The enforcement date for all EU countries was 25th of May 2018. Norway, not being a member of the EU, transposed the EU regulations into its national law in accordance with the provisions of the GDPR.
Secure configuration of Business NXT
User access in general
Access control is an important aspect of GDPR (knowing who has access to which data). In general access control is based on roles/access groups which determine what a user can do.
Access control in Business NXT

System administration
This is where you find important information about configuring and monitoring Business NXT, for example about setting up user permissions and roles, and about the system logs.
- Access management
  You create access groups and manage access, based on access groups, from the Access management page.
- Users
  User permissions in Business NXT are managed using roles and access groups.
- Companies
  You manage companies in Business NXT Admin.
- Variables
- Task overview administration
- Approval task
- Email configuration
  You can set up the email functionality for the entire system or for individual companies.
- Webhooks
  Webhooks are used to send real-time data between web applications, based on specific events, instead of constant polling.
- Data Model Extension (DME)
  Data model extensions allow you to extend and enhance the capabilities of the core data model.
- AI Connect
  You can use different AI-supported finance skills in Business NXT using the GAiA assistant and the AI Connect MCP server.
- Logs
  In Business NXT, some information is logged automatically, while other data can be logged if needed.
- Integrations
  For some Visma.net services that are integrated with Business NXT, you can start processings and also see the status of operations in dedicated tables.
- General Data Protection Regulation (GDPR)
  The EU General Data Protection Regulation (GDPR) replaced the Data Protection Directive 95/46/EC and was designed to harmonise data privacy laws across Europe, to protect and empower all EU citizens' data privacy and to reshape the way organisations across the region approach data privacy. The enforcement date for all EU countries was 25th of May 2018. Norway, not being a member of the EU, transposed the EU regulations into its national law in accordance with the provisions of the GDPR.
  - General aspects
    One aim of the GDPR is to protect all EU citizens from privacy and data breaches in an increasingly data-driven world. The key points of the GDPR as well as information on the impacts it has on businesses can be found below.
  - Secure configuration of Business NXT
    - User access in general
      Access control is an important aspect of GDPR (knowing who has access to which data). In general access control is based on roles/access groups which determine what a user can do.
      - Access control in Business NXT
    - Audit trail
      This section covers the necessary setup to establish an audit trail for relevant items.
  - Appendix
    This section contains additional information and a visualisation.

Access control in Business NXT

Access groups

With access groups, it's possible to limit which tables, columns or processings are available for users, and what users can do with the access. Access groups can limit users' possibility to read, edit, insert or delete data, either for the entire table or on column level. When a new access group is created from scratch (in contrast to copying from an existing access group), the access group has access to all data.

It's recommend to limit users' access to tables and columns that are relevant for their tasks.

Note:

Using access groups is the only method to restrict user access to data. For example, layout groups don't restrict user access to tables via APIs.

Layout groups

In Business NXT, there's a second concept on top of access groups. It's possible to restrict what a user is allowed to see in the application by the layouts connected to each user. It's the responsibility of each company using Business NXT to set up the access rights and layouts in a way that the users working in the system don’t see information or can’t change data which isn’t intended for their role in the company.

Note:

Remember that layout groups control only access to layouts, but don't limit access to the data, for example from another application that uses Business NXT APIs. Limiting access to the data must be configured using access groups.

With an increasing degree of labour division, it might be needed to separate roles (for example rights to create suppliers and update bank accounts from the rights to approve payments). Business NXT supports good control of that kind of configuration with the Access conflict definition table where a company can define which combination of rights shouldn’t be assigned to one single user. These definitions need to be implemented individually by each company using Business NXT.

It's recommended to set up the logging for the following tables:

User table
User access table
Company group table
Company group member table

Tip:

For tracking who sees what in the Business NXT screens/layouts it's recommended to set up logging for the Layout group and Layout group member tables.