Security

Your books have to stay accurate and private for years. This page describes how VexLedger protects them. It is a description of what we do, not a certification.

Your books cannot quietly change

• Entries must balance. Every transaction posts as balanced debits and credits. One that does not balance to the penny is refused before it reaches the ledger.
• Nothing is edited in place. A posted entry is never changed or deleted. If something was wrong, you reverse it and the correction sits beside the original.
• A full audit trail. Changes to the books and administrative actions are recorded, with who did what and when. The record is append-only.
• Locked periods. Once a period is final, you can close it so nobody can post into it. Reopening needs an owner or admin and a written reason.

Controlling who can see and do what

• Roles for every person. Owners, admins, brand admins, accountants, bookkeepers and read-only users each have the access their role allows, and only for the brands they are given. See the help.
• Two-step sign-in. Protect an account with a code from an authenticator app as well as the password. We strongly recommend it for anyone who manages an organisation.
• Sessions you can end. Sign-ins expire, and you can sign out every other device from your account.
• Separate customers. Each organisation’s data is kept separate from every other organisation’s.

Protecting data

• Passwords are stored only in a hashed form, never as plain text.
• Connections are encrypted between your browser and VexLedger.
• Keys you give us to connect other services, such as Stripe, are stored encrypted and are never shown again.
• Protection against abuse. Sign-in and our forms are protected against automated attacks and repeated attempts.
• Your accounting records and uploaded files are stored in the European Union, and the application that processes them runs there too. Connections reach it through a global network that also protects it from attack. It runs on a major cloud provider’s infrastructure with backups. See our data processing addendum for the list of providers.

Your part

• Turn on two-step sign-in and give each person only the access they need.
• Use a strong, unique password and never share it.
• Treat any API key like a password, and revoke it if it may have been seen.
• Tell us quickly if you think an account has been accessed by someone it should not have been.

Reporting a security concern

If you think you have found a security problem, or an account may be compromised, please contact us and mark your message as urgent. Please give us a reasonable chance to fix a problem before you share it publicly, and do not access other people’s data.

Questions

For anything else about how we handle data, read our privacy notice and terms of service.