Your finances deserve bank-grade protection

Okidoky handles sensitive information: income, expenses, receipts and sometimes bank statements. We treat that data the way we would want our own bank to treat it — with multiple layers of protection, clear procedures and honest communication.

This page describes the technical and organisational measures we take. We keep it up to date so you always know where you stand. Questions or anything unclear? Email us — we are happy to explain.

We encrypt your data at two moments: on its way to our servers, and while it's stored there.

We check our secure connection regularly to make sure everything is set up properly.

Your password is never stored in readable form. We only keep an unreadable version that can't be reversed — even we can't see your password, not even if our database were ever to leak.

• Minimum 8 characters at registration, with uppercase, lowercase, and digits required.
• Account creation and password changes go through the same strength validation — there's no "weak-password loophole".
• Too many failed login attempts in a row are blocked automatically, so no one can guess your password by trying endlessly.
• Forgot your password? Reset links are short-lived and single-use.

We do not know your password and cannot retrieve it. Okidoky staff will never ask you for your password — not by email, not by phone, never.

On top of your password you can switch on a second check. Without that second step no one can log in — even with your password.

Turn this extra protection on in your profile settings. In a shared ledger, each person can turn on their own extra protection.

Okidoky runs on servers within the European Union. That means all your data falls under the European privacy law and is not simply sent to countries outside the EU.

• Location: Servers and backups live in certified data centers in the EU.
• Network: Server-level protection blocks suspicious and excessive requests.
• Updates: Security patches for the operating system and dependencies are rolled out promptly.
• Keeping an eye out: We watch 24/7 whether everything works and whether anything suspicious happens — if there's a problem, we get an alert straight away.

Physical access to the data centers is limited to authorized personnel of the hosting partner. Okidoky staff has no physical access.

Receipts you upload are stored on the same secure infrastructure as your transaction data. Only you (and anyone you share the ledger with) can see them.

When you delete a receipt, the underlying file is removed from disk immediately, not just the reference.

We take regular backups so you never lose data — even in case of a server outage or accidentally deleted transactions.

• Daily automated backups of the full database.
• Backups are stored encrypted with a separate key.
• We keep daily, weekly and monthly backups going back up to a year. Older ones are cleared automatically.
• Restore procedures are tested periodically to guarantee that recovery works.

Even inside Okidoky, access to your data is minimal and everything is logged. No one here has more access than is strictly needed for their work.

For certain tasks we rely on specialised partners. We share only what is strictly necessary and sign a data processing agreement with each of them.

These are the main partners. The full list — including visitor statistics (only with your consent), ads for the free version and services that deliver fonts and icons — is on our sub-processors page. We announce new partners at least 30 days in advance. Complete sub-processors list →

We hope it never happens — but if there is ever a data incident, we follow a clear protocol in accordance with GDPR.

1. Detect: Monitoring systems alert us to suspicious activity or unusual patterns.
2. Assess: Within 24 hours we assess the scope, which data is affected and what the impact is.
3. Report: If a notification is required by law, we report the incident within 72 hours to the Dutch Data Protection Authority.
4. Inform: Affected users receive an honest, clear email about what happened and what they can do themselves.

We believe in transparency. Even if nothing bad actually happened but we could have done better, we share that — because we all learn from it.

Found a security issue? We'd love to hear it and thank serious reports with a mention on our thank-you list. Report it directly and securely:

We respond within 2 business days to any serious report and keep you updated on progress.

Under the privacy law you have clear rights as a user. At Okidoky these aren't paper-only rights — they're built into the app itself.

• View: see all your data in the overview and download it as a file or pdf.
• Rectification: change or delete transactions and profile data at any time.
• Deletion: email info@okidoky.nl and within 48 hours we delete your account. Your data is wiped from the backups once those get overwritten on a fixed schedule.
• Take it with you: download your full ledger in a readable format, ready to load in elsewhere.
• Objection and restriction: contact us if you want to restrict processing or object.

For full details about what we collect, why and how long we keep it, see our full privacy policy. Questions or complaints? Email us directly — or contact the Dutch Data Protection Authority.