Security overview

We keep the books for accounting firms and their clients, so protecting your financial data is central to how LedgerHub is built — not an afterthought. This page summarizes the technical and organizational measures we use. If you have a question, see “Reporting a concern” at the bottom.

All traffic to and from LedgerHub is encrypted in transit with TLS (HTTPS), and HTTP Strict Transport Security is enforced so browsers will not fall back to an unencrypted connection.

The most sensitive secrets we hold — your linked-bank access tokens, two-factor and authenticator secrets, and payment-provider keys — are encrypted at the field level with AES-256-GCM before they are written to the database, using keys held only on the application host.

• Passwords are stored only as salted, one-way hashes — never in plaintext.
• Passwordless sign-in with passkeys (Face ID, Touch ID, or a security key) via WebAuthn.
• Two-factor authentication with authenticator apps (TOTP) and one-time email codes, with optional trusted devices.
• Role-based permissions — only Owner and Accountant roles can post or change financial records; client-portal access is limited to viewing and uploading.
• Per-user company access and strict multi-tenant isolation, so each set of books is visible only to the people granted access to it.

Bank and card feeds are powered by Plaid. When you connect an account, you enter your bank credentials directly with Plaid — they never pass through or get stored on LedgerHub. We receive only a Plaid access token (encrypted, as above) and read-only transaction and balance data. These connections cannot be used to move money.

Invoice payments are processed by Stripe and PayPal. Card details are entered on their secure, PCI-compliant systems; LedgerHub never sees or stores full card numbers.

LedgerHub runs on Amazon Web Services — application compute plus an Amazon RDS for MySQL database — in the United States, behind Cloudflare for TLS termination and network protection. This system is operated by the accounting firm that keeps your books; it is not a shared public platform. Every company’s data is scoped to that company in the database, and access is granted per user, per company.

LedgerHub is operated by I&S Accounting Services and is not itself SOC 2 certified. Instead, we build on infrastructure and service providers that are independently audited, and we follow the practices described on this page. The providers we rely on, and their attestations, are:

The optional AI features (bank-feed categorization and “Ask your books”) use the Anthropic API over a limited, read-only set of your reports. Data sent to the API for these features is not used to train models.

You own your books. At any time you can export your full chart of accounts, transactions, and financial statements to CSV and Excel from the admin tools, and take them with you if you ever leave. There is no lock-in.

Changes to the books are recorded — who made them, when, and what the record looked like before and after. Bulk operations are recorded the same way, record by record: a bulk reclassification or a bulk register edit writes a separate entry for each affected line, with that line’s own before-and-after values, so a record’s history includes the bulk changes that touched it. The trail is scoped per company, so you see the history for your own books and nobody else’s, and it covers the ordinary edits that matter in an accounting system: posted entries, reclassifications, voids, and deletions.

Finished periods can be locked. Once a month or a year is closed, transactions dated inside it stop accepting silent edits — which is what makes a closed period actually mean something at review time.

Your books live in Amazon RDS, which takes automated backups and continuously archives the database transaction log — so the database can be restored to a chosen point in time rather than only to last night’s copy. Backups and snapshots inherit the instance’s encryption, so they are AES-256 encrypted at rest under a managed key.

Documents you upload — receipts, bills, statements and attachments — are stored on the application server, which is snapshotted automatically every day, with the seven most recent snapshots kept. That is a coarser guarantee than the ledger’s: files are captured once a day rather than continuously, so a recovery reaching back more than a week can restore your books to the minute but not the attached files exactly as they stood at that moment.

The service exposes a health endpoint that is verified on every deploy, and application errors are logged on the host for diagnosis.

We track published security advisories against the libraries LedgerHub is built on and apply patches on a regular cadence, prioritizing anything reachable from the parts of the app exposed to the internet.

If you believe you have found a security issue, please contact us at [email protected] so we can look into it promptly. We appreciate responsible disclosure, and we will not pursue action against anyone who reports a genuine issue to us in good faith and gives us a reasonable chance to fix it before disclosing it publicly.

Machine-readable contact details are published at /.well-known/security.txt.

Happy to answer them directly — write to [email protected], or go back to LedgerHub.