Our compliance status
What we do and don't have in certifications, and what our suppliers have.
Last updated: 30 September 2026
In short
Okidoky works in line with the GDPR, payments run through Mollie (licensed by De Nederlandsche Bank, the Dutch central bank) and our server is in Germany, at IONOS SE. Okidoky belongs to RULIDO, a sole proprietorship registered with the Dutch Chamber of Commerce (KVK) under number 98709364. A data processing agreement for organisations is being prepared: we will only publish it once a lawyer has reviewed it.
BUT: we don't have ISO 27001 or SOC 2 certifications ourselves. Those are €15,000-€40,000 per audit for a bootstrapped SaaS — not feasible right now. If you need a vendor with such a certificate: see our fallback section below.
Active compliance status
Six concrete points that apply now. Verifiable via public registers or on this website.
KVK registration
KVK 98709364
Registered with the Dutch Chamber of Commerce under number 98709364. RULIDO is a sole proprietorship (not a legal entity). Verifiable via kvk.nl.
VAT-liable entity
NL
VAT-registered in the Netherlands. Receives VAT-compliant invoices automatically. For B2B with valid VAT number: reverse charge.
GDPR/AVG-compliant
GDPR / AVG
We work in line with the GDPR: we process no more data than necessary, ask for consent where required, you can export your data and delete your account, and we report data breaches as the law requires. Privacy questions: info@okidoky.nl.
PSD2 payments
PSD2 via Mollie
All payments via Mollie B.V., which has a PSD2 license from De Nederlandsche Bank. Mollie handles strong customer authentication (SCA) under PSD2.
EU data hosting
IONOS SE · DE
Okidoky runs on a virtual server at IONOS SE in Germany; it holds the app, the database with your account and ledger, and our own mail server. What can end up outside the EU: what we send to OpenAI (US) — receipt photos and bank-import descriptions from Premium accounts, and the monthly totals for the monthly overview sent with the newsletter — and usage data via Google Analytics, AdSense and the font and icon servers. See the sub-processors page.
Public list of sub-processors
/sub-verwerkers
/sub-verwerkers lists the external services that can see user data, with purpose, data and country.
Honest about what's missing
Bootstrapped SaaS doesn't have all the certifications larger competitors do have. Here's what isn't right — and why.
ISO 27001 (Information Security Management)
Not (yet) heldInternational standard for information security management systems. Many enterprise customers expect this from vendors.
Why not: A first audit easily costs €15,000-€25,000, plus annual re-audits and hundreds of hours of our own work. For a sole proprietorship that is not feasible right now. Physical security of the data centre lies with our hosting provider IONOS (see the table below).
SOC 2 Type II (US standard)
Not (yet) heldAmerican auditing standard for service organizations, popular with US companies and SaaS. Focus on security, availability, privacy.
Why not: Even more expensive than ISO 27001 (€20,000-€40,000 per audit, again for Type II which assesses 6 months of behavior). Especially relevant for US market — we're NL/EU-focused. If we ever expand to US, this is the first we consider.
PCI DSS (direct)
Not (yet) heldStandard for secure processing of payment cards. Required for those processing card numbers themselves.
Why not: Not applicable to us: we NEVER process card numbers directly. All payments go via Mollie (PCI DSS Level 1 certified). We only see transaction IDs, never card details. PCI DSS we don't need — at bank level we indirectly do have it.
NEN 7510 (healthcare-specific)
Not (yet) heldDutch standard for information security in the healthcare sector.
Why not: Not relevant: Okidoky is for personal/household finance, no healthcare data. This standard is for hospitals, GPs and healthcare-SaaS. We explicitly document this because some audit lists ask about it.
Data processing agreement (DPA)
Not (yet) heldA data processing agreement sets out how we process data when we do so on behalf of an organisation, for example for coaches or associations.
Why not: The text is being prepared. We will only publish it once a lawyer has reviewed it. Does your organisation need one now? Email info@okidoky.nl.
Certifications we DO benefit from
Our main suppliers hold certifications that we don't (yet) have ourselves. Note: these apply to their own services, not to Okidoky itself.
| Provider | Certifications | What that means for you |
|---|---|---|
IONOS | ISO 27001 | According to IONOS itself, IONOS is ISO 27001 certified (stated in the IONOS data processing agreement). IONOS manages the data centre and hardware; we manage the software on the server (app, database, mail server) ourselves, and the certification does not cover that. |
Mollie | PCI DSS L1PSD2GDPR | All card data is processed by Mollie under PCI DSS Level 1. We never see your card number. |
OpenAI | SOC 2 Type 2GDPR (SCCs) | AI features under SOC 2 Type 2: receipt scan and bank-import categories (Premium) and the summary in the monthly overview sent with the newsletter. OpenAI does not train on your input data and does not store it permanently. The free receipt scan runs 100% locally. |
Certifications planning
Honest timeline for when we expect which certifications. No promises — indications.
Publish data processing agreement
Once a lawyer has reviewed the text, we will publish a data processing agreement on this website, with a version number and date.
ISO 27001 gap analysis
Hire external consultant for gap analysis. Identify which of the 93 controls we already actually apply vs what's missing. No audit commitment, but preparation.
Full ISO 27001 audit (if revenue allows)
At €500k+ annual revenue a full audit is discussable. This gives enterprise customers the paper they need. For now: too expensive, too much overhead.
This planning is our best estimate as of September 30, 2026. Circumstances (revenue, customer demands, regulation) can change the order. We update this at least yearly.
Do you need an ISO-certified vendor?
Some companies have an internal policy requiring ISO 27001 or SOC 2. That's a valid reason NOT to go with us — we don't want you to violate that policy by choosing us. Here are the options:
Concrete options
Fill out security questionnaire
Many enterprise security teams accept a completed questionnaire (VAIS, CAIQ, SIG) as alternative to formal certification. We fill out such a list within 2 weeks — mail security@okidoky.nl with your list.
Choose alternative vendor
For those who really need ISO 27001: Twinfield (Wolters Kluwer) or Exact — all ISO 27001 certified. Not for personal ledger perhaps, but for business admin yes.
Wait until we have it
If our roadmap (2028+) works for you: put us on a "reassess" list. We'll actively send notice once we have ISO 27001 certification — in your inbox within 5 minutes of certificate receipt.
Frequently asked compliance questions
Can I sign a DPA (Data Processing Agreement)?
Not yet. The data processing agreement is being prepared and will first be reviewed by a lawyer; after that we will publish it on this website. Does your association or organisation need one now? Email info@okidoky.nl and we will let you know when it is ready.
Is GDPR really enough for our company?
For most NL companies and associations: yes. GDPR is the strictest privacy law in the world. If you're compliant for your own processing, then we as processor are also compliant. Exceptions: • Healthcare sector: NEN 7510 required (then we're not suitable) • Financial sector needing bank-level accountability: ISO 27001 possibly required • US companies with EU data: SCCs are sufficient, but sometimes HQ also wants SOC 2
Why not do ISO 27001 anyway, even though it's expensive?
Three reasons: 1. Costs: an audit costs tens of thousands of euros plus hundreds of hours of our own work. That would have to come from the price, or at the expense of developing the app. 2. Little demand: for a household budgeting app, ISO 27001 is rarely a requirement. Those who do ask for it are usually large organisations that are not looking for a personal ledger. 3. Hosting: physical security of the data centre lies with IONOS. We handle the security of the server, the database and the app ourselves; that is what an audit would mainly be about. If this balance shifts, we'll reconsider.
Is your DPA template publicly available somewhere?
Not yet. We will only publish the data processing agreement once a lawyer has reviewed it. After that it will be on this website, with a version number and date, so you can always see which version applies.
Have you had a penetration test done?
Not formally yet (€5k-€15k per engagement). But: • npm audit on every dependency update (known CVEs resolved immediately) • Manual code review on every new feature • OWASP Top 10 as reference on every release • Responsible disclosure program via security@okidoky.nl A formal penetration test — along with automated CI scanning tools like Snyk or GitHub Dependabot — is on the 2027 roadmap.
Specific compliance question?
For questions about the data processing agreement, security questionnaires or your specific situation: mail us directly. Reply within 48 hours.