Security
Your accounting data deserves better than shared passwords and long-lived access in scripts. The platform is built so that every app only gets the access it needs, and nothing leaks when something goes wrong.
Only the access you grant
- Every app, access key and connected AI assistant starts with no access. You choose which administrations, which data and whether it may read, change or delete.
- Changing or deleting data needs its own permission; a read-only grant can never change anything.
- An administration stays off until you switch it on.
- Each app has its own connection to Exact Online, so one app never gets another app's access.
Protected sign-in
- Passwords are stored securely and repeated failed attempts are blocked.
- Two-factor authentication is required for organization owners.
- Changing your password signs you out everywhere.
Your data is encrypted
- Access to Exact Online, credentials for other connected systems and any data kept temporarily are stored encrypted, and everything travels over secure connections.
- Access keys are shown once and cannot be read back.
Passed through, not kept
Apps are designed to pass your data through rather than keep it. Where an app keeps data for a short time to be faster, it is optional, encrypted and deleted when you switch it off or disconnect. Each app's documentation explains exactly what it reads and stores.
Full transparency
- An audit log per organization shows sign-ins, permission changes, connections and every denied request. After you remove an organization, its audit log is kept for 30 days for security purposes and then deleted.
- Connected apps and AI assistants are listed and can be disconnected instantly.
Hosted on EU soil
Everything runs on servers in the European Union, locked down and checked for vulnerabilities regularly.
Roles
For your data, you are the controller and MVdW-Software is the processor. See the data processing agreement. Found a vulnerability? Mail info@mvdw-software.com.