Security and GDPR
Security of financial and HR data
Protection at many levels: from data isolation and encryption, through 2FA sign-in and the audit log, to secure deployments. We only describe what works in the product.
Company data isolation
Every table holding company data has row-level security enabled in PostgreSQL. The company context is set within the transaction, and isolation tests attempt to read and write other companies' data.
Encryption of sensitive data
Employees' PESEL numbers, two-factor authentication secrets and KSeF tokens are encrypted with the AES-256-GCM algorithm. PESEL is additionally masked in the interface.
Secure connections and sessions
Connections protected by HTTPS with HSTS, a CSP policy, security headers, and httpOnly, Secure and SameSite=Strict session cookies. Short-lived tokens with refresh token rotation.
2FA login and strong passwords
Passwords are hashed with the argon2id algorithm and must be at least 12 characters long (common passwords are rejected). TOTP two-factor authentication with one-time codes and lockout after failed attempts.
Permissions and personal data
Roles and separate permissions for HR data: revealing a PESEL requires permission and is recorded in the log. Invitations with protection of the last account owner.
Audit log and immutable ledger
Data changes and AI team actions leave a trail: who, what and when. The general ledger is append-only (corrections only through a correcting entry), and the balance is enforced in the database.
AI under your control
The AI team prepares, you approve: by default no action posts or sends anything without your consent, and each has a justification and a trail. The content of invoices and messages is treated as data, not as instructions.
Zaksio staff access
The administration panel runs on a separate domain with mandatory 2FA, additional confirmation of sensitive actions, a short session and an activity log. Access can be revoked immediately.
Backups
Database backups are encrypted, and an automatic restore test checks that a backup can be restored.
Secure deployments
Every change passes automated tests, and images are scanned for vulnerabilities. Deployment makes a backup before migration, checks the health of the application and rolls back automatically when something fails.
Abuse protection
Public endpoints have request limits, and forms have bot protection. The infrastructure runs in containers without administrator privileges.
Data in the European Union
We store data on OVHcloud servers in Gravelines, France (EU). Zaksio acts as a processor of your data and offers a data processing agreement (DPA).
RODO
Personal data and providers
Hosting in the European Union
The application runs on OVHcloud servers in Gravelines, France (EU). Zaksio acts as a processor of your data and offers a data processing agreement (DPA).
AI model provider
Zaksio connects to the language model through an abstraction layer that lets you choose the provider and region. We make the list of sub-processors available on request. We require the provider not to train models on customer data.
Individuals' rights and data export
Your data belongs to you, and exportability is a product principle even after a subscription expires. The organisation Owner downloads a full data export (JSON) themselves, from within the app; you can also export reports (profit and loss, balance sheet) to CSV, XLSX and PDF.
Responsibility for decisions
AI prepares, a human approves. Calculations are deterministic, and features where AI evaluates employees are deliberately not part of the product.
Manage smarter. Grow faster.
You can start with one company and a few invoices.
- Free, no card required
- Free Start plan with no time limit