Security and your data

Who owns the data

You do. Everything you put into Doodali belongs to you. Under UK GDPR you’re the controller and Doodali is your processor: we only use your data to run Doodali for you, following your instructions.

We never sell your data, never use it for advertising, and the AI providers we use don’t train their models on it. Our data processing agreement sets this out in full, and forms part of our terms.

Where it’s kept

Your data is stored on servers in the UK. A few specialist services we use, for example for sending email and for AI, are based outside the UK. Where data goes to them, it’s protected by the UK’s data transfer safeguards. Every provider, what it does and where, is listed in our privacy policy.

How it’s protected

• Encrypted in transit. Everything between your device and Doodali goes over HTTPS.
• Passwords are never stored. Only a secure, one-way scrambled version is kept, and passwords must be at least 12 characters.
• Secrets are encrypted. Connection keys (Google, Microsoft, Xero and others), two-step sign-in secrets, the bank details on your invoices and everything in the Passwords app are encrypted in the database.
• Bank detail changes are flagged. If the bank details on a business’s invoices are changed, its owners are emailed straight away and the change is recorded in the security log, so payments can’t be quietly redirected. Doodali support can’t see or change them.
• Each business is kept apart. Every request is checked against the business it belongs to, so one business can never see another’s data.
• Locked-down servers. The servers only accept secure connections, are signed in to with keys rather than passwords, are kept up to date, and are monitored around the clock, with alerts if anything fails.

Signing in safely

• Two-step sign-in with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password and others), with backup codes.
• Passkeys: sign in with Face ID, Touch ID, Windows Hello or a fingerprint.
• New devices are checked. Signing in on a device we haven’t seen before needs a code we email you.
• Repeated wrong passwords are blocked for a while, to stop guessing.
• Sessions end by themselves after 12 hours without use.

Who in your team sees what

You choose. Each person is given access to the businesses they work in, as a member or an admin, and teams decide which parts of Doodali each person can see: hidden, view only, or full. When someone leaves, deactivate them and they’re signed out straight away.

Can Doodali staff see your data?

Only if you ask us for help. Then someone on the Doodali team may open your account to see what you see and sort it out. It lasts two hours at most, each time is recorded, and your account’s owners are emailed every time it happens. Even then, some things stay hidden from us: your password vault, your staff’s HR records, documents and forms, what leave anyone is on and why, and your direct messages.

Otherwise we don’t look at the data in your account, except where the law requires it or to keep the service secure.

Backups

The database is backed up every night, and each backup is checked after it’s made. A copy of every backup is also kept away from our servers, encrypted, in Cloudflare’s storage in the EU, so a problem with one never takes the other with it. Backups are kept for up to eight weeks.

Getting your data out

Whenever you like. Every list (clients, contacts, deals, invoices and more) downloads as a spreadsheet from Settings → Import and export, ready to open in Excel, Numbers or Google Sheets.

If you close your account, your data is deleted from the live system straight away and drops out of our backups within about eight weeks. Billing records are kept for six years because the law requires it.

If something went wrong

No system is perfectly secure. If something ever happened that affected your data, we would tell you without delay, with what happened and what we’re doing about it, and report it to the Information Commissioner’s Office where the law requires.

Questions

If your business needs more detail, for example for a security questionnaire, get in touch and we’ll help.