Security Policy

1 Our Security Commitment

Ledgersys handles sensitive financial data. We treat that responsibility seriously. Our security commitments are:

2 Infrastructure Security

The Ledgersys platform is hosted on managed infrastructure with the following security properties:

• All connections to Ledgersys are encrypted via HTTPS using TLS 1.2 or higher. Unencrypted HTTP connections are redirected to HTTPS automatically.
• Our hosting environment is isolated from other applications and benefits from platform-level DDoS protection and network monitoring.
• Server access is restricted to authorised personnel only via key-based authentication. Password-based server login is disabled.
• Automated backups are performed daily. Backup data is encrypted and stored separately from the primary database.
• We monitor server logs continuously for suspicious activity patterns and failed authentication attempts.
• Software dependencies are regularly updated to incorporate security patches.

3 Data Encryption

In Transit

All data transmitted between your browser and the Ledgersys platform is encrypted using TLS (Transport Layer Security). This includes all API calls, CSV uploads, form submissions, and dashboard interactions. We enforce HTTPS across every page and endpoint — no exceptions.

At Rest

The following categories of sensitive data are encrypted at rest using AES-256 encryption:

• Exchange API keys and secrets submitted by users
• User passwords — hashed using bcrypt with appropriate work factor, never stored in plain text
• Session tokens and authentication credentials

Transaction data, tax calculations, and financial reports are stored in our secured database with access controls restricting direct access to authorised systems only.

Backups

Database backups are encrypted before being written to backup storage. Backup encryption uses the same AES-256 standard as primary data. Backups are stored in a location logically and physically separated from the primary database.

4 Account Security

Passwords

User passwords are never stored in plain text. When you set a password, it is immediately hashed using bcrypt — a deliberately slow hashing algorithm specifically designed to resist brute-force attacks. We store only the hash, never the original password. Even Ledgersys staff cannot see your password.

Session Management

User sessions are managed using cryptographically signed session tokens. Sessions are invalidated on logout, on password change, and after a period of inactivity. Session cookies are flagged as HttpOnly and Secure — they cannot be accessed by JavaScript and are only transmitted over HTTPS.

Protection Against Common Attacks

• Cross-Site Request Forgery (CSRF): All state-changing requests require a valid CSRF token that is verified server-side.
• Cross-Site Scripting (XSS): All user-supplied content is escaped before being rendered in the browser. We use templating systems that apply output encoding by default.
• SQL Injection: All database queries use parameterised statements. Raw SQL concatenation with user input is prohibited in our codebase.
• Brute Force: Login endpoints are rate-limited. Repeated failed authentication attempts trigger temporary lockout.

5 API Key Security

When you connect an exchange via API, you generate a read-only API key from your exchange and provide it to Ledgersys. Here is exactly how we handle it:

6 Payment Security

Card Payments

Card payment processing is handled entirely by our payment processor. Ledgersys never receives, processes, or stores your card number, CVV, expiry date, or any other payment card data. Our payment processor is PCI-DSS compliant. We only receive a payment confirmation and the transaction amount.

Bitcoin Payments

Bitcoin payments are processed via BTCPay Server — a self-hosted, open-source, non-custodial Bitcoin payment processor. When you pay with Bitcoin, a unique payment address is generated for your transaction. We record only the transaction amount and on-chain confirmation status. We do not store any information about your Bitcoin wallet or your on-chain identity.

Bitcoin transactions are irreversible once confirmed on-chain. Ensure the amount and address are correct before sending. Ledgersys cannot reverse or recover a Bitcoin payment sent to the wrong address or in the wrong amount.

7 Access Controls

Internal Access

Access to Ledgersys production systems is restricted to authorised personnel only. Access is granted on a least-privilege basis — each person has access only to the systems and data required for their specific role. All internal access is logged and auditable.

Your Account Data

Ledgersys staff do not access your account data, transaction history, or financial reports as a matter of routine. Staff may access data only in the following circumstances:

• At your explicit request for technical support
• To investigate a security incident affecting your account
• Where required by applicable law

All such access is logged with a reason recorded at the time of access.

Enterprise Role-Based Access

Enterprise plan holders can assign role-based access controls to team members — defining which data and functions each team member can access within their organisation's Ledgersys account. These controls are enforced server-side and cannot be circumvented by client-side manipulation.

8 Incident Response

In the event of a security incident, we follow a structured response process:

• Detection: Our monitoring systems alert us to anomalies in real time. We investigate immediately.
• Containment: Affected systems are isolated to prevent further exposure. Compromised credentials are invalidated.
• Assessment: We determine the scope of the incident — what data was accessed, by whom, and for how long.
• Notification: Affected users are notified by email within 72 hours of us confirming a breach. We will tell you exactly what happened, what data was involved, and what we are doing about it.
• Remediation: The vulnerability is patched and the fix is verified. A post-incident review is conducted to prevent recurrence.
• Regulatory notification: Where required by applicable data protection law, we notify the relevant regulatory authority within the required timeframe.

We will never downplay the severity of a security incident or delay notification to protect our reputation. Transparency is non-negotiable.

9 Vulnerability Disclosure

If you discover a security vulnerability in the Ledgersys platform, we ask that you report it responsibly. Please do not exploit the vulnerability or share it publicly before we have had a reasonable opportunity to investigate and remediate it.

How to Report

Send a detailed description of the vulnerability to support@ledgersys.live with the subject line "Security Vulnerability Report". Please include:

• A clear description of the vulnerability and its potential impact
• Step-by-step reproduction instructions
• Any proof-of-concept code or screenshots (where relevant)
• Your contact details so we can follow up

Our Commitments to Researchers

• We will acknowledge receipt of your report within 48 hours
• We will provide a status update within 7 days
• We will not take legal action against researchers who report vulnerabilities in good faith
• We will credit you in our security acknowledgements if you wish to be named
• We will notify you when the vulnerability has been remediated

10 Your Responsibilities

Platform security is a shared responsibility. Here is what we ask of you:

11 Security Updates

We continuously monitor our platform for security vulnerabilities and apply patches promptly when identified. For critical security vulnerabilities, we apply patches immediately — ahead of scheduled maintenance windows if necessary.

We update our software dependencies regularly to incorporate upstream security fixes. Our team reviews security advisories from our infrastructure providers, framework maintainers, and the broader security community on an ongoing basis.

Material security improvements are documented in our Changelog. Security incidents are documented on our System Status page.

12 Contact Us

For security-related enquiries, vulnerability reports, or to report suspicious activity on your account:

For non-security enquiries, please use our Contact page or visit the Help Center.