Trust & security
Taokeh holds a Malaysian SME's books — its sales, its cash, who owes what, the numbers you file to LHDN. For a tool like that, security and honest data ownership aren't a feature you add later; they're the product. This page sets out plainly how your data is protected, how the AI features stay on a leash, and how you take everything out whenever you choose to leave.
Every workspace is kept apart in the database itself — Postgres row-level security is enforced on every table, and every query runs scoped to your workspace. Isolation doesn't rely on the application code remembering to filter; it's enforced one layer down, where the data lives.
Every seat can use two-factor sign-in with an authenticator app, or a passkey. A workspace-wide require-2FA policy lets you insist on it for everyone.
Give each person only what they need. A viewer can look at the books but never post; posting rights are granted, not assumed.
Every posting lands on a hash-chained audit trail, so a later edit can't be quietly slipped in — a change to the history shows up.
Documents are corrected by void-and-repost, which preserves the original numbering. You get a clean, honest record of what changed — not an overwrite that pretends it was always this way.
Backups are encrypted with AES-256. Your books are backed up daily, with a fuller copy — attachments included — every week, and automatically on every schema change, so a structural update never leaves you without a fresh copy.
Once a month, an automated drill restores the latest backup into a clean environment and verifies every journal entry still balances to the cent before we call it good. A backup you've never restored is a guess; this one is checked.
An untested backup is a hope, not a backup — ours is rehearsed monthly.
Pull your books out whenever you like — reports and CSV exports, on your terms. We don't hold your data behind a "contact sales" wall to get it back.
If you stop paying, your workspace goes read-only — it isn't deleted. Every invoice, report and record stays readable and exportable for as long as you need it. Never deleted, never held hostage.
Want it all gone instead? Ask, and we'll delete it — write to dpo@taokeh.my.
The AI features — document scan, and the Ask Taokeh connector for Claude, ChatGPT and more — prepare drafts. A human reviews and approves every line before anything touches the ledger. The AI never posts.
Connector access is granted by you on a consent screen — read-only, or read + drafts — and it's revocable at any time. No assistant connects on its own.
Documents you scan are processed to extract the figures on them. They are not used to train AI models.
Taokeh runs on managed cloud infrastructure in Singapore — both the application and the database sit in the ap-southeast-1 region.
Email sent from taokeh.my is authenticated with SPF, DKIM and DMARC, so messages that claim to be from us can be checked as genuine.
The details are in our Privacy Policy, PDPA Notice and Data Processing Agreement. For any question about your data — access, correction or deletion — write to dpo@taokeh.my.
Everything on this page is how Taokeh works today — not a promise for later.