Security & Data Handling

A plain description of how Ledgerlot actually protects your account and documents — not a certification claim. We are not currently SOC 2 certified; if that changes, this page will say so.

Infrastructure

Ledgerlot runs on Vercel, with data stored in a managed Neon Postgres database and document/template files in Vercel Blob storage. All traffic to Ledgerlot is served over HTTPS/TLS, and data at rest is encrypted by these providers' infrastructure.

Authentication

Sign-in is via emailed magic links by default, with an optional password as a faster alternative — passwords are hashed with bcrypt and never stored in plain text. Sessions use signed, httpOnly JWT cookies scoped to the Ledgerlot domain.

Access control

Every document belongs to exactly one Organization. Access is granted per-folder or per-document to specific people (owner, invited participants, or an org admin), and a folder can be restricted to hide it from other org admins entirely. Within a Business organization, billing and member management are limited to the admin role — other members can't change seats, billing, or org-wide settings.

Payments

Ledgerlot never receives or stores your card details. Subscription payments are handled entirely by Stripe's hosted Checkout — card numbers go directly to Stripe, not through our servers.

Document audit trail

Every signature request keeps a full audit trail — who signed, when, and a tamper-evident record of the signing event. Detail like IP address, approximate location, and device/browser is retained for that legal record but deliberately kept out of the everyday admin-facing view, since an org admin doesn't need that level of detail about other people to do their job.

Retention & deletion

Documents are retained for a defined period based on your plan (7 years by default on every current plan), not indefinitely. You can request an export of your own account data — your profile, folders, documents, and signature history — at any time from Settings.

Questions

If you have a specific security question — for a vendor security review, a customer's IT team, or anything not covered here — reach out via the Support page and we'll answer directly.