Security at Occanovo
Last updated 26 October 2026.
This page is for business owners, and for IT or procurement teams checking Occanovo before their company uses it. It sets out where your data is kept, how it is protected, who can see it and how you take it with you. It describes what Occanovo does today, not plans. If something you need is not covered, email support@occanovo.com.
1. Who runs Occanovo
Occanovo is run by Occanovo Limited, registered in Ireland, company number 828620, registered office Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8. It is booking and business software for event and service businesses, and it was first built to run a working photo booth company in Dublin.
2. Where your data is kept
| What | Where |
|---|---|
| The application and its database | Hostinger, United Kingdom |
| Backups | Hostinger, Germany |
| Emails Occanovo sends, such as invitations and password resets | Hostinger, United Kingdom |
Payments, Facebook and Instagram lead ads, WhatsApp and the AI features use other providers, and only when you use them. The full list, with what each one receives and where, is in section 5 of our Privacy Policy. We give notice before adding a provider, and you may object on reasonable data protection grounds.
3. Protecting data
- Encrypted connections. Every page of the app is served over HTTPS only. Browsers are told to refuse plain connections for a year (HSTS), and pages cannot be framed by other sites.
- Connected accounts. Keys and tokens for things you connect, such as a Facebook page or another service, are stored encrypted with AES-256-GCM and used only to make that connection work. Disconnecting removes them.
- Passwords. Passwords are stored only as one-way hashes. Nobody at Occanovo can read them.
- Card payments. Card numbers never reach Occanovo's servers. Your customers pay through the payment provider you connect, such as Stripe, and the money goes straight to your account. Your Occanovo subscription is paid through Stripe in the same way.
- Separate workspaces. Each business has its own workspace. Every record is tied to its workspace, and people only see the workspaces they belong to.
4. Signing in
- Two-step sign-in. A code from an authenticator app such as Google Authenticator or Microsoft Authenticator, with recovery codes in case a phone is lost. Trusted devices can skip the code for 30 days. The owner can require two-step sign-in for the whole team.
- Sign in with Google or Microsoft. Your team can use their work Google or Microsoft account instead of a separate password.
- Slowing down guessing. Repeated wrong passwords for one account from one place are paused for a while. It is built so that nobody can lock an owner out of their own business by guessing on purpose.
5. Who can see what
- Roles. Owner, manager, staff and other roles, each with the access you choose. Some actions stay with the owner, such as changing pay rates or cancelling bookings.
- Private sharing for sales teams. When it is on, each salesperson sees only their own leads and deals, team leads see their team's, and managers see everything.
- Seats. You decide who has a login. Removing a person ends their access straight away; their work stays in the business.
- Audit log. On the Enterprise plan, a record of changes made by managers.
- Our access. Occanovo staff and contractors are bound by confidentiality, and only those who need access to fix a problem are given it.
6. Your data stays yours
- Export at any time. On every plan, download all your data as spreadsheets from Data and Backups.
- Import with undo. Bring customers and leads in from a spreadsheet, and undo the import within seven days.
- API keys. Connect your own systems with keys that can only read, or can read and write.
- No selling, no training. We do not sell, rent or use your data to train anything. The AI features (the help chat, filling in your details from your website at sign-up and matching spreadsheet columns on import) send the question or masked column headings, not your customers' details.
- When you leave. You have 30 days to export, then your data is deleted. Backups containing it are overwritten within 90 days.
7. Backups and availability
The full application and database are backed up by our host, with the backups held in Germany, for recovery after a serious fault. You can also keep your own copy at any time with the export. We aim to keep Occanovo available and to fix faults promptly. We do not offer a service level agreement unless one is agreed in writing, as our Terms of Service explain.
8. GDPR and data processing terms
For your account, Occanovo is the controller. For your customers' and staff's details, you are the controller and Occanovo is your processor. Our data processing terms are part of the Terms of Service (section 3), so every customer has them without signing anything extra. In short, we:
- process the data only to provide the service and on your instructions;
- keep it confidential and protected by the measures on this page;
- tell you without undue delay if a personal data breach affects your data;
- give notice before adding a provider, and rely on an adequacy decision or Standard Contractual Clauses if data leaves the EEA;
- help you answer your customers' data requests, and give you the information reasonably needed to show we meet these terms.
9. Reporting a problem, and questionnaires
Security issues. If you think you have found a security problem in Occanovo, email support@occanovo.com with what you found. Please give us a chance to fix it before telling anyone else. We read every report.
For your IT or procurement team. If your company needs a security questionnaire filled in, or a data processing agreement signed as a separate document, email support@occanovo.com and we will help.