Security
Your accounting belongs to you alone.
We describe what we actually do. No certificates we don’t have.
Measures
What is in the product today
Company separation in the database
Every table with company data uses PostgreSQL Row Level Security. A query only sees the rows of the company it runs for.
Passwords and sign-in
We store passwords as bcrypt hashes. Sign-in attempts are limited.
Two-factor authentication
Optional time-based codes (TOTP). The secret is encrypted in the database.
API keys and OAuth
We store only a hash of an API key, and you see it once. A key or an OAuth connection can be read-only. AI clients sign in with OAuth 2.1 and PKCE.
Short-lived sessions
An access token lasts 15 minutes. The refresh token changes on each use, and reusing an old one ends the session.
Immutable accounting entries
Posted entries are never edited, only reversed with a counter-entry. A closed period takes no new entries.
Roles and permissions
Permissions are checked on the server for every request, not just in the interface.
Your data is yours
Export everything as a ZIP of JSON, XLSX, PDF and attachments. Every change is written to an audit log, and webhooks are signed.
What we don’t claim yet
DameDoklad does not yet have ISO 27001 certification or a SOC 2 audit, and we do not publish an uptime guarantee. When that changes, it will say so here. Personal data processing terms and the list of subprocessors are in the data processing agreement.
Data processing agreementFound a bug?
Please email us a security finding before publishing it. We will reply and agree on next steps with you.
bezpecnost@damedoklad.czYour first invoice is a few minutes away.
Create your company, fill in the customer from ARES by IČO and send an invoice with QR payment.
Free Starter plan · No credit card