Security & data protection

Every company’s records are separated from every other company’s inside the database. The database checks who you are and which companies you belong to on every request, so the separation doesn’t depend on the app getting it right. Even a mistake in our app code can’t show one company’s books to another company.

• Before each release, an automated test suite tries to read and change other companies’ data, and every attempt has to be refused.
• The service has been through repeated independent security reviews by an outside auditor, and every finding was fixed and re-tested.

Each person gets a role in each company: owner, admin, accountant, bookkeeper or viewer. Viewers can look but not change anything. Only owners and admins can invite people, change roles, manage billing or see the audit trail. Invitations expire, and each one can be accepted only by the email address it was sent to.

Every create, change and delete in your books is recorded automatically by the database. That covers the general ledger, invoices, bills, payments, expenses, deposits, transfers, reconciliations, accounts, contacts, items and bank rules. Each record shows:

• who did it and exactly when
• a complete copy of the record before the change and after it

No one using the app, including a company’s owner, can edit or erase the audit trail. Owners and admins can review it under Settings → Audit log. When our own staff change something on your account, such as your plan, a trial extension or an add-on, that change is logged separately with who made it, what changed, and whether it succeeded.

When you close your books through a date, nothing dated on or before that date can be added, changed or deleted until an owner or admin reopens the period. The database enforces this, so it holds no matter how a change is attempted. Your filed numbers stay the numbers you filed.

• Your data is backed up automatically every day. Our database host keeps daily backups for 7 days on Amazon Web Services in the United States.
• We also make our own encrypted offsite backup every night, kept for 90 days, and the same job restores it into a fresh database and checks every table matches, so we know the backups actually work.
• Because the audit trail keeps a full copy of every record before each change, a single record changed or deleted by mistake can usually be put back exactly as it was. Nothing else in your books has to be rolled back.
• If something larger goes wrong, we can restore from a daily backup.
• If you need something restored, email support@irrational-optimism.com. A person will work with you directly.

• All traffic to IO Ledger is encrypted with HTTPS (TLS), and browsers are told to refuse unencrypted connections.
• Data is encrypted at rest (AES-256), including the database, uploaded documents and backups.
• Pages that show financial information are marked so they are never stored in shared caches.

• Card payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Card numbers go directly to Stripe and never pass through or rest on our servers.
• Bank connections run through Plaid. You sign in to your bank on Plaid’s secure screen, and we never see your bank login. The access tokens that keep your feed running are stored where no user account, including your own, can read them.
• Messages from Stripe and Plaid are cryptographically verified before we act on them, and each event is processed only once, so a repeated or forged message can’t post a payment twice.

• You own your data. You can export your reports to Excel or PDF at any time.
• On request, we will give you a full export of a company’s records in standard formats, whether you’re staying, leaving or just want your own copy.
• If your trial or subscription lapses, your company becomes read-only. Nothing is deleted then: you can still view and export everything.

• The accounts that control our code and database require two-factor sign-in, and access is limited to the people who run IO Ledger.
• We don’t browse customer books. We look at a company’s data only when the customer asks for help, or when we need to in order to keep the service secure.
• Database changes are versioned, tested against a full copy of the schema, and applied in single all-or-nothing steps.

If you believe you’ve found a security issue, please email support@irrational-optimism.com with details. We will respond quickly, keep you updated, and won’t take action against good-faith research that respects our users’ privacy.