Security

Last updated October 18, 2026

Our approach

LineLedger holds your books — financial records, contacts, payroll, and tax information — so security is a core part of the product rather than an afterthought. But the most important security fact about LineLedger is structural: we don’t run it, so we never hold your data.

There is no hosted LineLedger service. You install the software on infrastructure you control, which means the security of your books is a function of your server, your backups, and your access controls. This page describes what the software gives you to work with, what we are responsible for, and what you are.

What we can and cannot see

We cannot see your accounting data — not because we promise not to look, but because there is no path from your install to us. LineLedger does not phone home, does not check a license server, and ships no third-party analytics or telemetry in the application. If a court ordered us to produce your ledger, we would have nothing to hand over.

The only information we hold is what you deliberately send to lineledger.ca, lineledger.com or lineledger.co.uk: a contact-form message, a feature request, or the aggregate website analytics described in our Privacy Policy.

What the software gives you

Encryption

  • In transit: the application serves over HTTPS when you configure TLS on your deployment. The Docker quick start runs plain HTTP on localhost by design — put it behind a reverse proxy with a certificate before exposing it to a network.
  • At rest: application secrets and session data are encrypted with your APP_KEY. Database-level encryption at rest is a property of the storage you choose; the application does not encrypt the primary database itself.

Authentication and access control

  • Passkeys (WebAuthn) and two-factor authentication are supported, and an organization can require 2FA for its owners and admins.
  • Passwords are stored only as salted hashes — never in plain text.
  • Access within an organization is role-based: owners and admins control what each member can see and do, down to the section level. Removing a member or downgrading their role immediately tears down their sessions, API keys, and OAuth tokens.
  • API keys carry scoped abilities and per-key rate limits, and every API change is recorded in the audit log.

A tamper-evident audit trail

Every change to your accounting records is written to an append-only audit log, with each entry cryptographically chained to the one before it (a hash chain). This makes the record tamper-evident: after-the-fact alterations are detectable, and the chain stays verifiable across a backup and restore. Posted accounting entries are immutable by design.

Backups

The application exports any organization to a complete, portable ZIP that restores into a fresh organization. Scheduling those exports, storing them somewhere other than the server that produced them, and testing that they restore are your responsibility — there is no copy on our side to fall back on.

What you are responsible for

Running the software yourself means the operational security is yours:

  • Keep it patched. Security fixes arrive as new releases. docker compose pull && docker compose up -d applies them; an install nobody updates will eventually run known-vulnerable code.
  • Protect APP_KEY and PASSKEYS_USER_HANDLE_SECRET. They encrypt your secrets and anchor every registered passkey. Losing them is unrecoverable — by anyone, including us. Back up your .env somewhere separate from the server.
  • Terminate TLS properly and don’t expose the app directly to the internet over plain HTTP.
  • Secure the host: patch the OS, restrict SSH, firewall the database, and keep backups off-box.
  • Set the alert addresses in your .env so the nightly integrity and security checks reach someone who reads them.

Compliance posture

We are transparent about where we stand:

  • LineLedger is not SOC 2 certified, and a certification would mean little here in any case: SOC 2 audits a service provider’s operation of a service, and we operate nothing on your behalf. The controls that matter for your books are the ones on your own infrastructure.
  • Because we never receive your data, we are not a processor of it, and there is no data-processing agreement to sign. Our handling of the limited information this website collects is described in our Privacy Policy, with the providers listed on our Sub-processors page.
  • If you configure your install to take card payments so your customers can pay your invoices, that flows through Stripe (PCI-DSS Level 1) under your own Stripe account. Card data does not touch your LineLedger database, and it never touches us.

If you are evaluating LineLedger for a vendor review, the honest answer to most questionnaire items is “the software is audited by reading it” — the source is public, and the answer to “where does our data go” is “nowhere.” For anything else, email hello@lineledger.ca or hello@lineledger.com.

Transparency through open source

The LineLedger application is open source under the AGPLv3. Anyone can read the exact code they are about to run, review how it handles data, and report concerns. We consider this openness the primary security feature: you are not asked to trust a description of the software, because you can read the software.

The application also ships end-to-end accounting proofs you can run on your own install — php artisan proof:generate — so the correctness claims are checkable too, not just the security ones.

Reporting a vulnerability

We welcome responsible disclosure and are grateful to researchers who help keep LineLedger safe. Please do not report security issues through public GitHub issues or social media. Instead:

Please include enough detail for us to reproduce and assess the issue. We will acknowledge your report, keep you updated, and let you know which release carries the fix. We ask that you give us a reasonable opportunity to address the issue before any public disclosure, and that you test against your own install rather than anyone else’s. Full details are in our security policy on GitHub.