Security
Your books are separate, complete and unchanged
How Ledgr keeps each company's data apart, why posted entries never change, and what is logged.
Isolation by the database
All companies share one database, and every row carries its organisation. Row-level security in PostgreSQL makes the database itself return only the rows of the organisation you are signed in to.
Balanced, immutable postings
Every document posts balanced double entries — the database rejects an entry that does not balance. Posted documents are never edited; a correction is a reversal with its own date.
Append-only audit log
Creating, posting and cancelling documents is recorded: who, what and when. The log is only added to.
Roles and access
Owner, admin, accountant, assistant and view-only. Invitations by link, and access can be removed at any time.
Passwords and sessions
Passwords are stored as Argon2id hashes. Sessions are protected against cross-site request forgery.
Money in whole fils
Amounts are integers in fils, never floating-point numbers, and rounding follows one rule everywhere.
Record keeping in the UAE
UAE law requires VAT records to be kept for 5 years and corporate tax records for 7 years. Ledgr does not delete posted documents; cancelled ones stay in the books as reversals.
Report a security issue
If you believe you have found a vulnerability, please write to us from the contact page. Do not test against other people's companies.
ContactTry Ledgr with your own company
Ledgr is in its testing period: create a company in a few seconds, no payment and no card needed.