Oktra Data Processing Addendum & Sub-processors
Last updated 2026-07-23
Last updated: 2026-07-23 Applies to: the Oktra application (app.oktra.ai) and related services ("Oktra", "we", "us") Contact: privacy@oktra.ai
Published at https://oktra.ai/legal/dpa. This file is the source of truth; republish on any edit.
1. Purpose of this document
This page explains how Oktra handles your data when it acts as your processor, and lists the sub-processors we use. It complements the Privacy Policy, which is the primary description of what data we process and why; where this page and the Privacy Policy overlap, we point to the Privacy Policy rather than repeat it.
2. Roles: who is the controller and who is the processor
When Oktra does your bookkeeping, you (the customer) are the data controller of the financial data in your account, and Oktra is the processor acting on your documented instructions. We process that data for one purpose only: doing your bookkeeping - categorizing transactions, proposing accounting entries you approve, reconciling accounts, and producing reports for you. We do not process it for our own purposes, do not sell it, and do not use your financial data to train models for other customers or purposes.
For some data we act as an independent controller rather than your processor - for example, the account and billing data we need to run and bill the service, and security/audit records. The Privacy Policy describes those uses.
A full Data Processing Agreement covering the processor terms (purpose limitation, confidentiality, security measures, sub-processor conditions, assistance with data-subject requests, breach notification, and deletion/return on termination) is available to customers and is entered into as part of onboarding.
3. Purpose limitation and instructions
Oktra processes customer financial data only to provide the bookkeeping service and only on your instructions, as reflected in the Privacy Policy and your service agreement. Oktra never initiates or moves money; connections to banks are read-only. We do not use customer financial data for any purpose beyond delivering the service to you.
4. Sub-processors
We use a small number of service providers ("sub-processors") to host and support Oktra. Each is bound by data-processing terms, and we distinguish clearly between those that can process customer financial data (your accounting and bank-transaction data) and those that cannot.
| Sub-processor | Role | Location / region | Processes customer financial data? |
|---|---|---|---|
| Microsoft Azure (incl. Microsoft Entra ID) | Cloud hosting, databases, and encrypted credential vaults (Key Vault); Entra ID conditional access for administrative sign-in | EU region for EU customers | Yes - hosts and stores the application and its data, including accounting and bank-transaction data |
| Plaid Inc. | Bank connectivity: establishes the read-only bank connection you authorize and retrieves transaction data. Plaid processes end-user data under its own end-user privacy policy | United States (see Plaid's policy for regional processing) | Yes - read-only bank-transaction data, only when you connect a bank through Plaid |
| Zitadel Cloud | Identity and authentication provider (sign-in, passkeys/MFA, session identity), custom domain login.oktra.ai |
EU region | No - processes account identity and authentication data only, not accounting or bank data |
| Stripe | Subscription billing and payments (Checkout, Customer Portal, webhooks) | United States (merchant entity); card data is handled by Stripe and never touches Oktra's servers | No - processes billing and payment data only, not accounting or bank data |
| Vercel | Hosting for the public marketing site (oktra.ai) only; decoupled from the application and its data | United States / global edge | No - serves public pages only; the application (app.oktra.ai) and all customer financial data stay on Azure |
Some processing and storage also runs on servers Oktra operates itself in the European Union (Netherlands), under the same encryption and access controls as our cloud environments, as noted in the Privacy Policy.
5. What is not a sub-processor: your connected platforms
The systems you connect to Oktra - your accounting platform (such as Intuit QuickBooks Online or Informer) and your bank accounts (for example bunq or Wise) - are your own systems, not Oktra sub-processors. Oktra reads from them (and, for your accounting platform, posts the entries you approve) at your direction. Your relationship with each of those providers, including its own terms and privacy policy, is between you and that provider. Bank-connectivity providers you route a connection through, such as Plaid, act as our sub-processor for that connection and are listed in §4.
6. Changes to the sub-processor list
This list is reviewed and kept current. We update this page before engaging any new sub-processor that would process customer data, so the published list always reflects the providers in use. Material changes are announced in the application or by email where the Privacy Policy requires notice, giving customers the opportunity provided in their DPA to review or object before the new sub-processor begins processing.
Sub-processor list last reviewed: 2026-07-23
7. Contact
Oktra - privacy@oktra.ai