Security
Built like a ledger: nothing is quietly changed.
Ledger holds fiscal documents, tax credentials and your customers’ details. Here is how each is protected — in plain language, with no claims we cannot show you in the product.
Authentication
Sign-in runs on better-auth with httpOnly session cookies. A password policy rejects short, common and known-breached passwords, Cloudflare Turnstile keeps automated sign-in attempts out, and repeated failures lock the account for a cooling-off period. A password reset revokes every existing session, and privileged actions ask for a fresh password.
Tenant isolation
Every business is a tenant. Isolation is enforced inside Postgres with row-level security: each query runs in a transaction bound to one tenant, so another business’s rows are invisible even to a bug in application code.
Credential vault
Your INSA-certified signing credentials never sit in plain text. They live in an encrypted vault — AES-256-GCM with envelope encryption, a data key per establishment and a master key kept outside the database. Reads return masked previews; only the signing path decrypts.
Audit trail and wire log
Every registration exchanged with the Ministry of Revenues’ EIMS is stored verbatim — request and response — in an append-only wire log. Business actions, sign-ins and privileged operations land in an append-only audit trail that the database itself refuses to update or delete.
Encryption in transit
Traffic between your browser, the till, the API and the Ministry travels over TLS. Backups are encrypted with a separate key before they leave the database host.
Responsible disclosure
Found a weakness? Tell us before you tell anyone else. Report it through the support page or the contact address below; we will acknowledge it, fix it, and credit you if you wish. Please do not test against other businesses’ data.
Ledger has not yet completed an external security audit. This page describes the controls in the product today; it is not a certification.