How we protect your data

Data encryption

Your exchanges with Ledgerly go through a TLS 1.3 connection (or 1.2 for older browsers), rated A+ by SSL Labs. Our certificate is an Extended Validation (EV) certificate, issued in our company's name after verification of its identity. Sensitive data, such as your bank details, invoice lines and authentication secrets, is encrypted at rest with AES-256-GCM, using a key unique to each account and stored separately from the data.

Passwords and two-factor authentication

Your passwords are never stored in clear text, they are hashed with Argon2id, the algorithm recommended today. We require at least 12 characters and reject passwords known to have been leaked. Two-factor authentication, by app or email, locks access to your account.

Separation between accounts

Each user only ever sees their own data. This isolation is checked automatically by a battery of tests on every update, and any attempt to reach data that is not yours is blocked and logged. The Ledgerly team does not consult the content of your invoices: for support, it only has access to technical indicators (number of documents, sending status, type of error), and every consultation is logged.

Hosted in Switzerland

Your data is hosted in Switzerland, at Infomaniak, on infrastructure certified ISO 27001. Switzerland benefits from a European Union adequacy decision, so your level of protection remains fully GDPR-compliant.

Encrypted backups

Your data is backed up several times a day, encrypted, and kept separately in Switzerland on Infomaniak's Swiss Backup service. In the event of an incident, it can be restored.

Transparency in case of an incident

In the event of a data breach, we notify our customers without delay, and the data protection authority within 72 hours, as required by the GDPR.

Security researchers can also report a vulnerability to us through our responsible disclosure policy.