Ledgeforge security statement
DRAFT 0.4 for attorney review, 22 October 2026. Not published. Not in force.
Public statement. Every measure listed must be true on the day it is published: see the "must be true before publishing" list in 00-index.md.
1. Where your data lives
All Ledgeforge products (Accounting, FinSight, Loadwyse, the login and portal, and Billing) run in Amazon Web Services' Cape Town region (af-south-1), South Africa. Uploaded files and backups are kept in private, encrypted storage in the same region. Each product has its own database.
2. How we protect it
Signing in
- One central login for every product, with two-factor sign-in (authenticator app) required for every staff User.
- One active session per person: a new sign-in ends the older one. Signing out anywhere signs you out everywhere.
- A new password is refused if it appears in a known data breach. The check sends only the first 5 characters of a one-way hash of the password; the password itself never leaves our systems.
- A bot check (Cloudflare Turnstile) and rate limits on the sign-in page.
- Sign-in pages never reveal whether an email address has an account.
Keeping Customers apart
- Every request is checked on the server against the User's membership of the organisation.
- Accounting and Loadwyse also enforce separation inside the database (row-level security).
- Each product has automated tests that try to read and write another Customer's data, run on every change.
Encryption
- All connections use HTTPS (TLS), with HSTS.
- Databases, files and backups are encrypted at rest.
People and access
- Only named Ledgeforge staff can reach the production systems, at present only the director. Production secrets are held in a secret store and are never in code or chat.
- When we look at a Customer's data to help with a support request, the access is logged.
- Important actions (closing an organisation, exports, role changes, payments) are recorded in an audit log kept for 7 years.
Payments
- Card details are entered with PayFast. Ledgeforge never sees or stores full card numbers.
Backups
- Nightly encrypted backups, each kept 35 days, with restores tested.
- Emails from the Services come only from a verified ledgeforge.co.za address. We add no tracking pixels and no advertising.
3. If something goes wrong
If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person:
- For Customers' data (where the Customer is the responsible party), we tell the affected Customers' owners immediately, and in any case within [24] hours of becoming aware, with what we know and what we are doing. We then keep them updated and help them meet their own duty to tell the Information Regulator and the people affected.
- For our own Account Data (logins, billing), we notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA s22 requires, unless a public body responsible for investigating crime tells us that notifying would hinder an investigation.
4. Reporting a weakness
Please report suspected security problems to [security@ledgeforge.co.za]. Tell us privately and give us a reasonable time to fix it. We will not act against anyone who reports in good faith and does not access, change or keep other people's data.
5. Questions
Contact the Information Officer (see our Privacy Notice).