Security overview
Updated 25 August 20263 min read
On this page
Ledgerline holds financial records and moves money, so security is part of the product, not an add-on. This page summarizes how data is protected, what controls you have and which attestations we maintain.
Encryption
| Layer | Protection |
|---|---|
| In transit | TLS 1.2 or higher on every endpoint. TLS 1.3 is preferred and negotiated by default. Older protocols are refused. |
| At rest | AES-256 encryption for databases, backups and file storage. |
| Keys | Each organization has its own data encryption key, wrapped by a master key in a hardware-backed key management service. Data keys rotate every year. |
| API keys | Stored as one-way hashes. We cannot show a key again after creation. |
| Webhooks | Signed with HMAC-SHA256 per endpoint. See Verifying webhook signatures. |
Access controls for your team
- Two-factor authentication is mandatory for every dashboard user. Use an authenticator app (TOTP) or a passkey.
- Roles. Owner, Admin, Developer and Viewer, each limited to what the role needs.
- SAML single sign-on is available on the Scale plan.
- Session limits. Dashboard sessions expire after 12 hours of inactivity, and sensitive actions, such as creating a live key, ask you to re-authenticate.
Access controls for the API
- Restricted keys limit what a key can do. See Restricted keys and scopes.
- IP allowlists on Growth and Scale plans reject requests from outside the CIDR ranges you configure with
ip_not_allowed. - Mutual TLS is available on the Scale plan: Ledgerline only accepts connections from clients that present a certificate you issued.
- Key expiry and rolling. See API keys.
Audit log
Every sensitive action in the dashboard and API, such as creating or revoking a key, changing a role, editing a webhook endpoint or submitting verification, is written to the audit log with the actor, the time, the IP address and the request id. Retention depends on the plan:
| Plan | Retention |
|---|---|
| Starter | 90 days |
| Growth | 400 days |
| Scale | 400 days, plus a continuous export stream to your own storage |
Attestations and testing
- SOC 2 Type II, audited annually, covering security, availability and confidentiality.
- ISO 27001 certification for the information security management system.
- Penetration tests twice a year by independent firms, with a summary available under NDA.
- PCI DSS is not in scope. Ledgerline does not store card data.
Reports are available from Settings > Compliance in the dashboard for approved organizations.
Application security
Ledgerline runs dependency scanning, static analysis and secret scanning on every change. Production access is limited to named engineers, requires hardware security keys and is logged. Public GitHub repositories are scanned for exposed ll_live_ keys, which are revoked automatically when found.
Your side of the shared responsibility
Important
Ledgerline secures the platform. You secure the credentials and the code that calls it.
- Keep secret keys out of source control, browsers and mobile apps.
- Use restricted keys and IP allowlists wherever possible.
- Verify every webhook signature and reject unsigned requests.
- Remove team members promptly when they leave.
- Send an idempotency key with every write so retries cannot duplicate money movement.
Reporting a vulnerability
Use the security form in Help > Report a vulnerability in the dashboard. Reports are triaged within one business day. We do not take action against good-faith research that follows the rules in the program terms shown in that form.
Where data lives
Region, residency and retention are covered in Data residency and retention.