Data & Security

How we protect your data

Aukly holds your financial documents and books, so protecting them is part of how the product is built. These are the safeguards in place today.

Last updated 31 October 2026

1. Encryption

  • In transit: every connection between your browser and Aukly uses HTTPS (TLS), and browsers are told never to connect to Aukly without it.
  • At rest: the database and file storage are encrypted on disk by our providers.
  • Secrets: keys and passwords for our systems are kept only in our hosting environment, never in the source code.

2. Card payments

Payments are handled by Paystack, which is certified to PCI-DSS Level 1, the highest level of the card industry's security standard. You enter your card details on Paystack's own secure page. Card details never pass through or get stored on Aukly's servers.

Before giving you any pages, Aukly asks Paystack directly what was paid, and checks the amount and currency against its own price list. Payment notifications are rejected unless they carry a valid digital signature from Paystack.

3. Passwords and sign-in

  • Passwords are never stored. Only a salted, one-way fingerprint is kept, using an algorithm designed to be slow to attack.
  • Weak and commonly used passwords are refused, following current NIST guidance.
  • You must verify your email address before you can sign in.
  • Repeated wrong passwords temporarily lock the account, and repeated attempts are slowed down.
  • Sign-in passes are short-lived and digitally signed. The sign-in cookie can't be read by page scripts and is only ever sent to Aukly over HTTPS.
  • If a copied sign-in cookie is ever reused, Aukly signs the account out on every device.
  • Sign-in, sign-up and password reset give the same answer whether or not an email is registered, so they can't be used to find out who our customers are.

4. Keeping customers apart

Every customer's data is separated by two independent checks: each request asks only for the signed-in customer's records, and the database layer adds a second, automatic filter for the customer's identity. A customer's identity comes only from their signed sign-in pass, never from anything the browser sends, so it can't be swapped by editing a request. A document that belongs to someone else behaves exactly like one that doesn't exist.

5. Uploaded documents

  • Only supported file types are accepted. Each file is checked by its declared type, its name and its actual contents, so a disguised program or web page is rejected.
  • Files have a size limit, and malformed files designed to overload a server are detected and refused.
  • Files are stored privately under random names, with no public access.
  • The AI only suggests categories. It can't access other data, send anything or change your books. Nothing is booked until you approve it.
  • CSV exports are protected so that a cell can't run as a spreadsheet formula when you open the file.

6. Staff access

  • Only named Aukly staff can open the back office. They need their normal sign-in and a code from an authenticator app, and back-office sessions expire quickly.
  • The back office is read-only. It can't change a customer's account, and it shows masked email addresses and totals, never the contents of documents.
  • Every back-office session and every customer look-up is recorded in an audit log.
  • Access to our providers' consoles is limited to the people who need it.

7. Privacy by design

  • Aukly's own software doesn't log or store IP addresses. It uses them for a moment, in memory, to limit abuse. Our hosting providers keep standard connection logs for security, as our Privacy Policy explains.
  • Server logs use internal reference numbers, never email addresses or document contents.
  • The website has no advertising or tracking scripts.
  • Error messages never reveal internal details of our systems.
  • When you delete your account, your documents, books and account details, including the files in storage, are erased automatically after 14 days.

8. Monitoring and testing

  • Aukly checks itself around the clock for failing documents, refused payments, forged payment messages and service outages, and alerts our team when something goes wrong.
  • We test these protections ourselves, including simulated attacks on a test copy of Aukly covering sign-in, customer separation, uploads, payments and staff access, and we fix what we find.
  • The software libraries Aukly uses are checked for known vulnerabilities, and security updates are applied.

9. Backups

Our database provider takes automatic backups of the Aukly database, so it can be restored if a server fails.

10. Incidents

No system is completely secure, so we plan for things going wrong. If we suspect that personal information has been accessed or acquired without authority, we act straight away to contain it. We notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires. Our Privacy Policy explains what that notice includes.

11. Reporting a security issue

If you believe you have found a security weakness in Aukly, please email privacy@aukly.co.za with the details, and give us a reasonable time to fix it before telling anyone else. Please don't access or change other people's data, or disrupt the service, while investigating.