Security & data
Security posture, in plain terms
Oktra reads the books and banks you authorize, posts only the bookkeeping you approve to your accounting platform, and never moves money. This page summarizes how we protect that data; the detailed policies are linked throughout.
Connection scopes & no payment initiation
Bank connections are read-only by design: the bank-integration layer exposes no money-movement operations at the interface level, and third-party credentials are provisioned at the lowest capability the provider offers (read-only tokens where available; single-product API scopes). Access to your accounting platform is limited to the bookkeeping service: Oktra reads your books and posts only the entries you approve — your platform remains the system of record, and all writes are idempotency-protected so replays cannot double-post. There is no payment initiation: Oktra never initiates or moves money.
Authentication & MFA
Customers authenticate with a password or passwordless passkey plus phishing-resistant multi-factor authentication (passkeys / WebAuthn — platform biometrics or hardware security keys). An MFA-verified session is required before any financial-connection surface is presented, and sensitive actions re-verify the factor. Sessions are short-lived with server-side revocation and inactivity timeout; session cookies are Secure, HttpOnly, and SameSite. Identity and sign-in are handled by a dedicated identity provider.
Encryption in transit & at rest
Customer data is encrypted in transit (TLS everywhere; HTTPS-only public endpoints) and at rest in every storage location, wherever it is hosted — platform encryption on cloud databases and storage, full-volume encryption on datacenter-hosted systems, encrypted backups, and vault-held secrets under HSM-backed platform keys.
Access control & least privilege
Least privilege is the default: every service identity is granted the minimum role on the minimum scope, and role-assignment rights are constrained to the secret-access roles only. Customer data and production credentials are never stored at rest on workstations or office hardware.
Data retention & disposal
Retention is deliberately short: your accounting platform remains the system of record, so Oktra keeps working data only as long as needed. Financial data is erased within 30 days of account offboarding or a verified erasure request; connection secrets are revoked at the provider and then purged from the vault. See the Data Retention & Disposal Policy for periods per data class and disposal methods.
Sub-processors
We use a small number of service providers to host and support Oktra, each bound by data-processing terms. We distinguish clearly between those that can process customer financial data and those that cannot. The public DPA & Sub-processors page lists every one, its role, and its region.
Responsible disclosure
If you believe you have found a security issue, please contact us at privacy@oktra.ai. We welcome responsible disclosure and will work with you to confirm and address valid reports.