Trusted with the books.
Ledgerline works inside your ledger, your bank data and your customer relationships. These are the controls that make that safe.
-
SOC 2 Type II
Independently audited controls across security, availability and confidentiality.
-
Encrypted
Data encrypted at rest and in transit, everywhere it lives.
-
Not for training
Customer data is never used to train AI models.
-
On the record
Every agent and human action is logged and attributable.
Compliance
Ledgerline, Inc. maintains a SOC 2 Type II report covering the security, availability and confidentiality trust services criteria. Controls are tested by an independent auditor over an observation period, not at a single point in time.
The current report is available to customers and prospects under NDA. Request it from our security team.
Data handling
- We access only the systems and scopes you approve: typically your ERP, bank feeds, the AR inbox and specific customer portals.
- Customer data is logically separated per tenant and is never shared between customers.
- Your data is never used to train AI models, whether ours or a third party's. Model providers we use are contractually bound not to retain or train on it.
- Retention follows your contract. When you leave, data is deleted on request and confirmed in writing.
Encryption
Data is encrypted in transit and at rest across production systems and backups. Credentials for ERPs, banks and portals are stored in a dedicated secrets manager, encrypted, and never shown to staff or written to logs.
Access control
- Role-based access inside the product: decide who can approve, who can post and who can only view.
- Staff access to production follows least privilege, requires strong authentication and is logged and reviewed.
- Agents act with the permissions you grant and nothing more. Write access can be limited to specific entities, accounts or actions.
Audit trail
Every action, whether taken by an agent or a person, is recorded with a timestamp, the actor, the change and the reason. Entries cannot be edited after the fact. Auditors and controllers can trace any number back to the transactions and decisions behind it.
Agent guardrails
- Thresholds you set decide what agents may do on their own and what needs a person, such as write-offs above a set amount.
- Exceptions are routed to a named owner with full context. The agent waits for a decision and does not guess.
- Agents can be paused per workflow at any time, without affecting the rest of the system.
Subprocessors
We use a small number of vetted subprocessors to run the service. The current list:
Named vendors are listed in our data processing agreement. We notify customers before adding a subprocessor.
Responsible disclosure
If you believe you've found a vulnerability, email security@ledgerline.ai with the details and steps to reproduce. We acknowledge reports within two business days, keep you updated while we fix the issue, and won't take legal action against good-faith research that respects user data and service availability.