Data protection
- Encrypted in transit. Every page, upload and download goes over HTTPS.
- Encrypted at rest. Cloudflare encrypts the databases and stored files at rest.
- A database per case. Each case's accounts, transactions, tags and notes live in a database of their own. It has no address on the internet; the only way in is through the app, after it has checked the case belongs to your firm.
- Private file storage. Uploaded PDFs are kept in a private bucket with no public link. The app serves a file only after the same firm and case check, and tells browsers and proxies not to keep shared copies.
- Point-in-time recovery. The account database and each case's database can be restored to an earlier point if something goes wrong.
Where your data is held
The app, its databases and your uploaded files are all held with Cloudflare. Statements are read by OpenAI. Not all of this happens in Australia, and we don't offer Australian data residency yet.
Your firm may need to treat this as a disclosure overseas under Australian Privacy Principle 8. If you need the specific regions for that assessment, email john@ledgersignal.com and we'll tell you.
How AI reads your statements
When you upload a statement, the PDF is sent to an OpenAI model that finds each account and statement period and reads out the transactions. The call goes through our Cloudflare AI gateway with logging turned off, so the gateway doesn't keep the PDF or the result. OpenAI doesn't use data sent through its API to train its models.
Tags such as transfers, related parties, gambling, wages and loans come from a decision model running on Cloudflare Workers AI, through the same gateway. It sees transaction details such as descriptions, dates and amounts, and the related parties you list on the case, not the PDFs. Cloudflare doesn't use Workers AI inputs to train models.
Plain-English search sends your question, along with the case's account details and tag names, to OpenAI. It doesn't send the case's transactions.
Access and sign-in
- Your firm, by invitation. Anyone can start a firm of their own once they've confirmed their email, but nobody joins yours without an invite to their email address. Invites expire after seven days.
- Checked on every request. The app checks that you are still a member of your firm each time you load data, so removing someone takes effect straight away.
- Roles. Members do the everyday work. Only owners and admins can delete cases or bank accounts, delete other people's files and notes, change firm details, or invite and remove people.
- Passwords. Passwords are stored only as hashes. Reset links expire after an hour, and resetting your password signs you out everywhere else.
- Requests from our site only. The app refuses changes that don't come from LedgerSignal's own pages.
Keeping and deleting data
- You decide how long. A case stays for as long as you need it.
- Export any time. Download transactions as CSV with your tags, notes and the file and page each row came from.
- Delete a file. The PDF and everything read from it are removed.
- Delete a case. Its database and every file uploaded to it are removed together.
- Close your account. Ask us and we delete your firm's data within 30 days.
Subprocessors
These are the companies that handle your firm's data on our behalf. Our privacy policy and data processing agreement say where each one holds it.
| Provider | What it does | Certifications |
|---|---|---|
| Cloudflare | Runs the app and holds its data: the account database, each case's database, uploaded files, the AI gateway, the decision models that tag transactions, email and site analytics. | SOC 2 Type IIISO 27001 |
| OpenAI | Reads uploaded statements to find each account and its transactions, and turns plain-English searches into filters. | SOC 2 Type II |
| Google Workspace | Our email inbox, for messages you send us. | SOC 2 Type IIISO 27001 |
What we don't have yet
We'd rather you hear it here than in a questionnaire.
- Our own SOC 2 or ISO 27001 certification. The providers above hold theirs; LedgerSignal itself hasn't been audited yet.
- Australian data residency. See where your data is held, above.
- Two-factor sign-in or single sign-on. Sign-in is by email and password.
- Access by case within a firm. Everyone in a firm can see all of its cases.
Questions
Who at LedgerSignal can see our data?
The app has no back door into your firm. We can reach stored data through our Cloudflare account, as the people who run the service, but we only look at a case to help with a problem you've raised, and only with your permission.
Who in our firm can see a case?
Every member of your firm can see every case in it. Roles decide what people can delete and manage, not what they can see. If you need to keep a case from some of your team, talk to us first.
Can you sign an NDA or confidentiality agreement?
Yes. Email john@ledgersignal.com with yours, or ask for ours.
What happens to our data if we stop using LedgerSignal?
Export what you need as CSV, then delete your cases, or ask us to close your firm's account. We delete a closed firm's data within 30 days.