Security

How we protect your books.

Your books are the most sensitive thing about your business. Here is what we actually do about that, in plain terms.

Your login

Passwords are stored as Argon2 hashes. We never store or see your actual password.
Your session uses a short-lived access token held only in memory and a rotating refresh token in a cookie that page scripts can't read. If an old token is ever replayed, that whole session is signed out.
Sign-in and sign-up attempts are rate-limited to slow down guessing.

Each business's records are separated by the database itself (row-level security), not just by application code. A bug in our code can't quietly show one business another's numbers.
All traffic uses HTTPS, and the app sends strict browser security headers, including a nonce-based content security policy.
We never ask for your bank login. You bring a statement; nothing is connected.

When you upload a receipt or a PDF statement, or ask the assistant a question, that content is sent to Anthropic's Claude API to be read and answered. CSV imports never leave our servers for AI.
The model can only read your books through a small set of read-only questions. It cannot post, change or delete anything. It can draft a suggestion, such as filing several charges under one category, but nothing happens until you press Apply, and every applied item can be undone.
We don't trust what it returns: amounts are re-checked with plain arithmetic, statements must add up to their own closing balance, and every suggestion waits for your approval.
Your original files are stored with your books so every number can be traced back to its receipt.

The ledger is append-only. Posted entries can't be edited or deleted; a mistake is corrected by a visible reversal.
Every entry must balance, enforced by the database.
An audit trail records who changed what, when, and what it looked like before.

LedgerAI is early. It hasn't had an independent security audit or a compliance certification yet.
Backups and point-in-time recovery are being upgraded as we grow.

Found something that looks wrong? We want to hear about it. Meanwhile, you can set up your books and judge for yourself.