SOC 2
In progressControl environment under formalization. Targeting SOC 2 Type I, then Type II, as Ledgera pursues institutional customers.
Security & Trust
Here is exactly how Ledgera protects your data.
Ledgera is the financial and operational infrastructure layer for service and industrial companies. That role only works if institutions trust how we handle their data. This page states - without marketing language - how we secure it today and what we are building toward.
Current trust status
ISO 27001
PlannedRoadmapped after SOC 2 Type II. Reuses the same control set to reduce effort.
Encryption in transit
ActiveTLS 1.2+ everywhere: customer traffic, API traffic, and database connections.
Encryption at rest
ActiveProvider-level disk encryption plus AES-256-GCM application-layer encryption for integration credentials and tokens.
Tenant isolation
ActiveCross-tenant path and body access enforced in middleware and covered by automated tests.
Audit logging
ActiveSensitive route access is logged per user, method, path, and company. Backups are encrypted and restore-tested.
Data architecture
Customer data is processed on US-hosted infrastructure. Systems of record (ServiceTitan, QuickBooks, banks, payroll) stay at the customer. Ledgera connects to them over authenticated, encrypted integrations.
Customer
Browser / API clients
Vercel + Supabase Edge
TLS · CDN · Auth
Railway API
Express · rate limits · tenant isolation
Encrypted PostgreSQL
US region · encrypted backups
AES-256-GCM credential encryptionBigQuery analytics warehouse (US)Sentry error monitoring
Security controls in operation
These controls are implemented in the platform today and are subject to automated tests and CI scanning.
Identity & access
- ✓Authentication via Supabase GoTrue (JWKS-verified) with legacy signed-token fallback
- ✓Role-based authorization and per-company tenant context
- ✓MFA enforced on GitHub and admin access
- ✓No production credentials in repositories - secret scanning gates every push
Application security
- ✓CSP and COEP security headers via Helmet
- ✓Global rate limiting plus strict limits on webhooks
- ✓Webhook signature verification (Stripe, Twilio, Calendly, DocuSign)
- ✓Dependency and secret scanning in CI (Gitleaks + npm audit)
Data protection
- ✓Multi-tenant isolation with automated regression tests
- ✓Encrypted automated backups with tested restore procedure
- ✓Encrypted storage of OAuth tokens and API credentials
- ✓CORS allowlist enforcement in production
Observability
- ✓Sentry error monitoring on backend and frontend
- ✓Audit logging on sensitive routes
- ✓Application health checks and automatic restarts
- ✓Usage analytics without selling or renting customer data
Compliance roadmap
Ledgera does not claim certifications it does not hold. This is the path to institutional-grade compliance, each stage triggered by real customer requirements rather than speculative spending.
Secure MVP
Tenant isolation, encryption, rate limiting, audit logs, tested backups, secret scanning, and this Trust Center.
Procurement-driven hardening
Close gaps exposed by real security questionnaires. Formalize access reviews, staging parity, and control narratives.
SOC 2 Type I → Type II
Continuous evidence collection via a compliance platform, independent auditor, annual penetration test, and workforce SSO.
ISO 27001 & data residency
Regional data architectures (US/EU/CA), customer SSO, and advanced governance as institutional customers require.
Our security journey
Security is not a snapshot - it is a compounding record of controls shipped, policies published, and audits passed. This timeline is append-only: every milestone is dated and retained, so you can see how Ledgera's program has improved over months, years, and decades - and hold us to it.
- 2026-08-19Evidence program
Operational security evidence program
Published six auditable procedures - access control, change management, vulnerability management, encryption & key management, data retention & deletion, and security monitoring - converting code-level controls into evidence-producing operations.
- 2026-08-19Controls
Secret hygiene hardening
Added repository-level protections that block credential files from ever being committed, closing a high-severity finding from the August security audit.
- 2026-08-19Controls
Secure Git access
Deployed secret scanning in CI (gitleaks) and npm audit gates, plus pre-commit and pre-push hooks, so every push is scanned for credentials and vulnerable dependencies.
- 2026-08-19Controls
Rate limiting and CI cleanup
Removed the duplicate global rate limiter and cleaned duplicated CI steps. A single enforced rate-limit posture (100 requests/15 min global, 10/15 min webhooks) is now in effect.
- 2026-08-16Policy
Incident response runbook
Published severity-classified incident response: SEV0-SEV3 definitions, containment and recovery phases, customer notification obligations, and a quarterly tabletop checklist.
- 2026-08-16Policy
Data map published
Documented every data class, its sensitivity and retention, all US-region storage locations, integration data flows, subprocessors, key inventory, and logs.
- 2026-08-15Program
Institutional security masterplan
Published the codebase-audited roadmap to institutional trust: tenant isolation, JWKS auth, AES-256-GCM credential encryption, tested backups, and a phased path to SOC 2 and ISO 27001.
What we have committed to next
Q4 2026
First formal quarterly reviews
Access, vulnerability, and retention reviews with incident response tabletop.
H1 2027
SOC 2 readiness assessment
Control narrative draft and gap analysis with an independent auditor.
2027+
SOC 2 Type I, then Type II
Independent examination after controls operate for 3-6 months.
Future
ISO 27001 & data residency
Regions, customer SSO, and advanced governance as customers require.
Subprocessors
We share customer data only with subprocessors required to operate the service. We do not sell customer data. A full data processing agreement is available on request.
| Subprocessor | Role | Region |
|---|---|---|
| Vercel | Frontend hosting & edge delivery | US / Global edge |
| Railway | Backend hosting (US region) | US |
| Supabase | Authentication & PostgreSQL database | US |
| Google Cloud / BigQuery | Data warehouse for analytics | US |
| Stripe | Billing & payment processing | US |
| Twilio | Call tracking & messaging | US |
| Sentry | Error monitoring | US |
| Calendly | Scheduling | US |