Security incidents
No app is completely without risk. That's why we keep a public list of problems and how they were resolved. Here you see the current status and what we do if something happens.
Last reviewed: 24 April 2026
No problems to report
Current status: everything works, no known leaks
Serious data leaks
0
Leaks with personal data
Unauthorized access / long outage
0
Unauthorized access or prolonged outages
Tracked since
1 January 2024
Since this page went online
We update this page on every new problem. Something not right? Email security@okidoky.nl.
How we handle problems
Four firm rules for how we report problems. Not to scare you — so you know what to expect from us.
Everything is reported publicly
Even problems that ultimately had no impact. Rather a line on the list saying 'resolved within 1 hour, no data was visible' than silence that later raises questions.
Reported within 72 hours
The privacy law requires a data breach to be reported to the regulator within 72 hours. We use the same deadline for the report here on the site.
Full explanation after every problem
For each reported problem: what happened, when, who it affected, how it was resolved and what we learn. Just in plain language.
Affected users notified directly
Email to the accounts it affects within 72 hours (even if it's fewer than 10). Not just an update on this page — we actively get in touch where needed.
4 levels for 4 situations
Not every problem is equally serious. How we report it depends on the severity — so you can see for yourself how big something was.
- Level 1
Data breach with personal data
Unauthorized access to accounts, transactions or other personal data. Direct impact on users.
Response time: Public report within 24 hours + direct email to affected accounts + report to the regulator
- Level 2
Unauthorized access / prolonged outage
Attack attempt detected, unauthorized access to our own systems (NO customer data), or more than 4 hours where everything is down.
Response time: Public report within 72 hours + explanation of the cause + plan to prevent it happening again
- Level 3
Elevated risk / near-miss
A weak spot found by us or by someone who reports it properly. Fixed before it could be misused.
Response time: Public report within 14 days + the version it was fixed in + thanks to whoever reported it
- Level 4
Outage (not a security problem)
Outage of 1-4 hours without a security cause, or emails that are delayed. No impact on your privacy.
Response time: Report on the status page (not here). See status.okidoky.nl.
What counts as a security problem?
Not every little glitch is a security problem. Here's what does and doesn't count.
DOES count
Unauthorized access
An account that got access that wasn't permitted.
Data exposure
User data that became publicly visible, even briefly.
Confirmed vulnerability
A security bug that could be exploited, or was.
Does NOT count
Planned maintenance
Announced maintenance windows with advance notice.
Outage at a supplier
For example the email service we use has an outage. See the status page.
Glitches without privacy impact
Screen glitches, errors in a report, typos — we track those separately, not here.
Edge case? Then we'd rather report it than not.
What happens when something is reported?
From the first signal to the explanation afterwards — here's how we work.
- T+0h
We notice it
Via our own monitoring, a report from outside, or a message from a user. Then we pick it up right away.
- T+0-1h
Stop it first
We shut down the affected part and revoke any access. This happens within an hour — first stop the damage, only then inform everyone.
- T+24h
Report and inform
Email to affected users + a report on this page + (for a data breach) report to the regulator within 72 hours.
- T+14d
Resolve
We find the cause, fix it and keep an extra close eye out. The list above gets the status 'resolved'.
- T+30d
Explanation afterwards
Within 30 days: a detailed explanation. What went wrong, why, what we learned and what we do to prevent it happening again. Right here on the page.
Report a problem
Found a weak spot? Let us know so we can fix it before anyone misuses it. We always respond personally.
Reporting channel
security@okidoky.nl
For sensitive details you can encrypt your mail. Ask us for the key.
Reward
Mention + thanks
We're too small to pay out money, but for a confirmed serious problem you get a mention on this page with your name and link — plus a year of free Premium or a Lifetime licence as a thank you.
What we ask of reporters
- Report it to us first — give us at least 90 days to fix it before you make it public
- Don't view or copy real user data (use a test account you create yourself)
- No attacks that take our systems down
- Between your report and our fix: don't use the weak spot for personal gain or to reach data
For security tools
For automated security tools we keep a standard small file online with our contact address and a link to this page.
/.well-known/security.txtFrequently asked incident questions
Why should I trust an empty list? Anyone can claim 'no incidents'.
Legitimate skepticism. A few things: 1. If we hid something, it would come out. Reports to the regulator and investigations can be traced. 2. We're registered with the Chamber of Commerce (98709364). Knowingly lying about security makes the owner personally liable. 3. We keep our server logs for 90 days, so we can show everything in an investigation. But: you don't have to take our word for it. You can compare every report here against public sources.
What if a supplier (like our hosting or the payment service) has a data breach?
Then we report that here too — even if the cause isn't with us. We stay responsible toward you. See /sub-verwerkers for the full list. Concretely: our hosting has had no major data breaches as far as known. The payment service had a phishing incident in 2024 (no data breach) — that didn't affect us, because our connection runs directly between servers.
How do I know this page isn't just always on 'no problems'?
Good question. A few ways to check: 1. The internet archive (web.archive.org) saves this page from time to time. You can see for yourself whether we've changed anything. 2. At every problem, the 'last reviewed' date above would change and the counter would go up. Want our work checked by an independent party? We can arrange that.
Do you also report to the regulator?
For a data breach with personal data: yes, within 72 hours, as the law requires. We then report to both affected users and the regulator. For less serious problems that isn't required; we do report those here on the page.
Why don't you give a money reward for problems found?
Honestly: we're too small to give money for it. Such a program also attracts a lot of low-quality reports that cost time. Our approach: whoever reports a serious problem gets a personal mention on this page + a year of free Premium — and for ongoing help, a Lifetime licence as a thank you. As Okidoky grows, we'll look at it again.
How we protect your data
A page like this doesn't prevent problems — but we can show what we do to keep risks small. Read our security measures or view the sub-processors.