Overview
At LedgerSync, we prioritize security with robust measures to protect our clients’ data. Here is an overview of our security protocols.
1. Bank Sign-In and Credentials
For most connections, the account holder signs in at the bank or through Mastercard or MX. LedgerSync receives a secure access key (a token) instead of the password and does not see that password. For connections made with LedgerSync’s own connection technology, the sign-in details the account holder chooses to save are stored encrypted so LedgerSync can retrieve that account’s data.
2. Two-Factor Authentication (2FA)
LedgerSync supports authenticator-app two-factor authentication, for example with Google Authenticator, Microsoft Authenticator or Authy. Each user turns it on for their own login, and we recommend it for everyone, especially administrators. See:
Two-Factor Authentication (2FA) Setup
3. Role-Based Access Controls
- LedgerSync uses role-based access controls.
- The Rules Engine keeps an audit log of who changed rules, categories and review actions, when the change occurred and which client it affected.
4. Data Encryption
Data is encrypted in transit using TLS and at rest. Bank data is retrieved through regulated aggregators (Mastercard Open Finance and MX) that maintain their own bank-grade security and compliance programs.
5. Read-Only Bank Access
Through a bank connection, LedgerSync retrieves only balances, transactions, statements and, where enabled, check images. It never moves money, pays bills or makes transfers.
6. Hosting and SOC 2
LedgerSync’s main platform is hosted on Google Cloud. LedgerSync’s own connection technology runs on Amazon Web Services. Databases, statement and check-image files, and backups are stored on Google Cloud in the United States. Google Cloud publishes SOC 2 Type II reports on Google’s own infrastructure and services. LedgerSync does not currently have its own SOC 2 report, and Google’s reports do not cover LedgerSync’s application.
Need Help?