LedgerPro · by Streetwise Software Online · SWSO
Security
Your financial records deserve care. This page describes the protections built into LedgerPro today. We only list measures that are actually in the software.
Your account
- Passwords are stored only as salted one-way hashes made with PHP's password_hash function; nobody can read your password, including us. Passwords must be at least 10 characters.
- Repeated failed sign-ins are slowed down: after 8 failed attempts within 15 minutes for the same email or network address, sign-in is paused for 15 minutes.
- Your session ID is replaced every time you sign in, and the session cookie is HttpOnly and SameSite=Strict, and marked Secure when the site is served over HTTPS.
- Every form and data change requires a secret anti-forgery (CSRF) token.
Your data stays yours
- Every record is tied to its owner, and every read or change checks that it belongs to the signed-in user and company, so one customer can never open another customer's data.
- All database queries use prepared statements, which prevents SQL injection, and everything shown on screen is escaped to prevent cross-site scripting.
- The database and your receipt files sits in a private folder that the web server refuses to serve.
- Spreadsheet exports are protected against formula injection.
- Receipt uploads are limited to images and PDFs up to 10 MB and are checked by file type, file signature and image decoding before they are stored.
The browser side
- A strict Content Security Policy only allows scripts and styles from LedgerPro itself, and pages cannot be framed by other sites.
- No third-party trackers, analytics, advertising or font services are loaded.
Payments
Card payments are handled entirely by Stripe on Stripe's secure checkout. Card numbers never reach our servers. Messages from Stripe to LedgerPro are accepted only when their cryptographic signature checks out and is less than five minutes old.
What you can do
- Use a long password you do not use anywhere else, and sign out on shared computers.
- Export a backup of your data from time to time.
- Tell us straight away if you notice anything unusual on your account.
What we do not claim
LedgerPro does not yet offer two-factor sign-in, and we do not currently hold third-party security certifications such as SOC 2 or ISO 27001. We will update this page if that changes.
Reporting a security problem
If you believe you have found a vulnerability, please email [support email] with the details and give us a reasonable time to fix it before telling anyone else. Please do not access other people's data or disrupt the Service while testing.