Automation your auditors can trace.
We automate the work between systems for banks, insurers and billing operations: invoices, customer records, cases and customer service. Every change is checked against the system that holds the truth, every module is documented, and the systems run in your environment, not ours.
Problems we can take on
In a high-volume, thin-margin back office, the exceptions decide the cost, not the volume. These are the places we have built automation that takes the routine cases and leaves people the rest.
Invoice handling
Software robots take the simple invoices and people handle the complex ones, with every step logged and every module documented.
Customer records against the register
Addresses and contact details that went stale, found and corrected against the national register that holds the truth, within what your customer terms allow.
Cases and agreements
New agreements checked and approved without waiting in a queue, and resolved cases closed without manual steps.
Customer service handover
Chatbot and live agents on different vendors' platforms joined, so the agent sees the whole bot conversation, and robots that handle customer email.
What we can show
Since 2018 we have built and maintained seven automation processes for AutoSync, Norway's largest AutoPASS issuer. Its 36 people send around 20,000 invoices a day, on a margin the regulator sets at 1.75%, so every manual step matters.
Our first work there was customer service: the handover between the Bold360 chatbot and the Genesys agent desktop, and the first robots on customer email. Genesys's published story about that service reports that more than half of chat enquiries are solved automatically and that email replies fell from five days to 24 hours. Those are Genesys's figures, for the whole service.
Working with us under DORA
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to banks, payment and e-money institutions, investment firms, insurers, pension institutions and other financial entities (Article 2(1)). It has applied in the EU since 17 January 2025 (Article 64), and in Norway since 1 July 2025, when it entered the EEA Agreement.
Under DORA, the financial entity stays fully responsible for its obligations when it uses technology suppliers (Article 28(1)(a)), and it passes many of them down through the contract. Below are the contract terms and checks DORA sets for suppliers, and how we already work against each one.
| What DORA asks for | Where | How we work |
|---|---|---|
| A clear and complete description of every function and service the supplier provides | Art. 30(2)(a) | A written specification of every function, approved by you before we build. Every later test traces back to it. |
| The countries where the services are provided and where data is processed and stored | Art. 30(2)(b) | Systems and data run in your environment and stay where you keep them. Our engineers work from Belgrade, Serbia, through remote sessions into that environment. |
| Protection of the availability, authenticity, integrity and confidentiality of data | Art. 30(2)(c) | We host no client data on our own infrastructure. Access is through accounts you or your IT provider create, and you can remove them at any time. |
| Access to and return of your data if the supplier stops trading or the contract ends | Art. 30(2)(d) | Your data never leaves your systems, so there is nothing to recover from us. The specification, test evidence and module documentation are handed over with the system. |
| Help during an incident, at no extra cost or at a cost agreed in advance | Art. 30(2)(f) | Incident support and its cost are set out in the contract, as this article requires. |
| Termination rights and notice periods | Art. 30(2)(h) | You can remove our access at any time. Support runs to an agreed end date. |
| An exit strategy, with a transition period, for services that support critical or important functions | Art. 28(8), 30(3)(f) | Every module is documented and your team is trained until it runs the system without us, so moving the work in-house or to another supplier does not depend on us. |
| Due diligence on the supplier, and appropriate information security standards | Art. 28(4)(d), 28(5) | We answer supplier questionnaires in full and say plainly where we do not meet a requirement. Security and data handling. |
| Extra checks for a supplier outside the EU, including EU data protection and the enforcement of law in that country | Art. 29(2) | Serbia is outside the EU. We work inside your systems, so your data stays where you keep it, and if personal data would leave the EU or EEA we sign the European Commission's standard contractual clauses before it does. |
How an engagement runs
- Paid discovery. A short, fixed piece of work that ends in a written specification you own, whether or not we build it.
- Fixed-scope build. We build what the specification says. Changes are written down before they are made.
- Support with an end point. Optional monthly support, with a date when your team runs it without us.
We give a price on the first call, once we understand the scope. The six steps every engagement follows.
Bring one process from your back office.
Tell us which systems it touches, where the exceptions pile up and who signs off. An engineer replies within one business day with the questions we would ask before writing a specification.
Email office@noni-soft.com