Security overview

Ledgerly helps businesses manage their money, so security is part of every decision we make. This overview describes the main controls we use to protect the Services and customer data. It is updated regularly and supplements our Terms of Service and Data Processing Addendum.

Program and governance

Our security program is led by our Chief Technology Officer and a dedicated security team that reports to the executive team and the board. We maintain written policies for access control, change management, incident response, vendor management and business continuity, and review them at least once a year. Every employee completes security and privacy training when they join and annually thereafter.

Independent audits

Ledgerly completes a SOC 2 Type II examination each year, performed by an independent audit firm, covering the security, availability and confidentiality trust services criteria. Customers can request the latest report under a nondisclosure agreement from their account settings. Our card program is also assessed for compliance with the Payment Card Industry Data Security Standard.

Infrastructure

The Services run on a major cloud infrastructure provider in multiple availability zones within the United States. Production environments are separated from development and testing environments, and customer data is never used in testing without being anonymized first. Network access is restricted by default, and only the services that need to communicate are allowed to do so.

• Infrastructure defined as code and reviewed before every change

• Automatic failover across availability zones

• Encrypted backups taken continuously and tested regularly

• Recovery targets: four hours for service, fifteen minutes for data

Data protection

All customer data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Card numbers and bank account numbers are tokenized and stored in an isolated environment with additional access restrictions. Encryption keys are managed in a dedicated key management service and rotated on a regular schedule.

Access control

Ledgerly employees receive access only to the systems they need for their role. Access to production systems requires single sign-on, hardware-backed multi-factor authentication and a connection from a managed device. Access to customer data requires a documented business reason, is granted for a limited time and is logged. We review access rights every quarter and remove them the same day an employee leaves.

Application security

Every code change is reviewed by at least one other engineer and checked by automated tests and security scanners before it reaches production. We follow secure development practices aligned with the OWASP Top Ten and run dependency scanning to find and fix vulnerable libraries quickly. Independent security firms perform penetration tests of our applications and infrastructure twice a year.

Account protection

We give customers the tools to protect their own accounts and to control exactly who in their team can move money, and how much.

• Two-factor authentication required for every user, with support for authenticator apps, passkeys and hardware security keys

• Single sign-on through Google, Microsoft and SAML providers

• Roles and permissions for viewing balances and approving payments

• Dual approval for payments above an amount you set

• Alerts for new devices, new payees and changes to bank details

• A complete audit history of sign-ins, approvals and settings changes

Fraud prevention

Every card transaction and outgoing payment is screened in real time by fraud models that look at amount, merchant, location, device and past behavior. Suspicious activity is held for review or declined, and the account owner is notified. Our risk operations team monitors alerts around the clock and can freeze accounts and start payment recalls at any hour.

Funds protection

Customer deposits are held at FDIC-insured partner banks. Through a sweep network that places funds across several program banks, eligible balances receive pass-through FDIC insurance up to $5 million per business. FDIC insurance covers the failure of an insured bank and is subject to certain conditions and limits.

Vendor management

We assess the security of every vendor that processes customer data before we engage them and review them at least once a year. Vendors are bound by contracts that require appropriate security measures and prompt notice of any incident.

Incident response

We maintain a written incident response plan that defines roles, escalation paths and communication steps, and we test it with exercises at least twice a year. If a security incident affects customer data, we will notify affected customers without undue delay and in line with our contractual and legal obligations.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in the Services, please email security@ledgerly.com with a description and steps to reproduce it. We acknowledge every report within one business day, will not take legal action against researchers who act in good faith and follow our disclosure guidelines, and offer rewards through our public bug bounty program.