In short
A plain-English summary. The full text below is what applies.
- Read-only QuickBooksLedgerlight reads your clients' books and never changes them.
- Two-factor sign-inEach firm decides who needs a code; Ledgerlight's own team always does.
- Encrypted, then encrypted againEverything travels and rests encrypted; QuickBooks access and the files clients send get AES-256-GCM on top.
- Backed up dailyBackups kept 30 days, in Google Cloud in the United States.
Hosting
- Ledgerlight runs on Google Cloud (Cloud Run and Cloud SQL for PostgreSQL) in the United States, in Google's Iowa region.
- The database has no public address: the app reaches it over a private network, encrypted, with its certificate checked.
- Keys and passwords the app uses are kept in Google Secret Manager, not in the code.
Encryption
- Every connection to Ledgerlight is encrypted (HTTPS, with browsers told to insist on it).
- Google encrypts the database and its backups on disk.
- QuickBooks access tokens, QuickBooks company ids, two-factor secrets and the files clients send their firm are encrypted again by Ledgerlight, with AES-256-GCM and a key kept in Secret Manager.
Signing in
- Passwords are at least 12 characters and are stored only as scrypt hashes. Session tokens, one-time links and recovery codes are stored only as hashes too.
- Repeated sign-in attempts, wrong two-factor codes (5 at most) and reset requests are limited.
- Two-factor authentication with an authenticator app: each firm decides who must use it (its owners and staff, unless it chooses otherwise), and Ledgerlight's superadmins always do.
- Sign-ins last 7 days, or 12 hours for superadmins. Anyone can sign out their other devices, and a password reset signs out everywhere.
Who sees what
- A firm's owners and staff see its clients. A client sees only their own business, and only the reports the firm publishes.
- Owners manage their team, and see an activity log of changes in the firm: invitations, connections, reports, settings and more.
- Ledgerlight's support team can look into a firm to help, without being able to change anything; each look is recorded in the firm's activity log.
QuickBooks
- Ledgerlight only reads from QuickBooks Online; it never changes a client's books.
- A connection can be ended at any time, from Ledgerlight or from QuickBooks. Ledgerlight revokes its access when a connection is ended, a client is removed or a firm is deleted.
Backups and monitoring
- The production database is backed up daily, with backups kept 30 days, and can be restored to any moment in the last 7 days.
- Every QuickBooks update is recorded, and a connection that stops working is flagged to the firm's team by email.
- Emails come from Ledgerlight's own domain, authenticated with SPF and DKIM.
- Ledgerlight keeps a record of each email it sends, but not its text, since emails can carry sign-in links.
Leaving Ledgerlight
- A firm's owners can download all of its data as a ZIP file at any time.
- When a firm closes, its data is deleted 30 days after the deletion is scheduled, and leaves the backups within a further 30 days.
Found a security problem?
Tell us what you found and how to see it. We'll reply, keep you posted, and fix what's real. Please test only with your own account, don't open or change anyone else's data, don't disrupt the service, and give us reasonable time to fix a problem before telling others. We won't pursue anyone who looks for problems in good faith this way.
Our Data Processing Addendum makes these measures a commitment to every firm.
Questions about these documents?
Write to us. We'll answer by email, and help with what your lawyer or your clients ask.