In place
Every family kept separate
The database itself refuses to show one family's records to anyone outside that family, including advisors who work with several families.
Checked by an automated test
What we do, and what we do not do yet.
Your family's records are some of the most sensitive data there is. This page lists every control we claim, and the ones we are still building. Controls shown as in place are checked by an automated test.
Last reviewed 1 October 2026
In place
In place
Two-step sign-in required
Everyone signs in with a password and a code from an authenticator app. Without the code, the database returns no family data.
Checked by an automated test
In place
A record of every change
Each change is logged with who made it and when, including changes made by imports. The log cannot be edited.
Checked by an automated test
In place
Access matched to the role
People see only what their role and the entities they are given allow, and access can be set to expire.
Checked by an automated test
In place
Household staff never see financial data
Staff accounts are blocked from all financial records, and no permission can override that.
Checked by an automated test
In place
Advisors keep clients apart
An advisor working with several families sees one family at a time. Families are never combined or searched together.
Checked by an automated test
In place
Documents stored privately
Files are private, and only people who can see the record a document belongs to can open it.
Checked by an automated test
In place
Mistakes can be undone
Earlier versions can be restored, deleted records can be brought back, and the owner can require approval for sensitive changes.
Checked by an automated test
In place
Your data is yours to take
The owner can download a complete copy of everything in the family workspace at any time.
Built into the product
Planned
Planned
Hosting in the EU
Oikos has not been deployed yet. We plan to host in the EU, and will say so here when it is true.
Planned
Extra encryption for sensitive fields
Tax numbers and similar fields are not separately encrypted yet. We will add this before any real family data is used.
Planned
Passkeys
Sign-in with a passkey is planned. Authenticator-app codes work today.
Planned
Backups and recovery
Backups and recovery drills depend on deployment and are not in place yet.
Planned
Independent security test
We plan an independent penetration test before the product is released to the public.
Planned
Data processing agreement and deletion on request
A data processing agreement and a way to ask for deletion are planned before launch.
Planned
Alerts for unusual activity
Alerts for unusual exports or sign-ins are planned.
Planned
No training of AI models on your records
Our assistant, Ruppert, is not built yet. We intend never to train AI models on customer records, and will put that in our terms.
Not planned yet
Not planned yet
Security certifications
Formal certifications such as ISO 27001 are not planned yet. They cost more than an early product can justify.
Oikos is in development and is not yet available to the public. No real family data should be entered until the planned controls above that protect it are in place.