Security

Books that protect themselves

Letting an AI keep your books only works if the ledger cannot be corrupted. Here is exactly how LedgerMCP guarantees that, in plain language, with every claim enforced in the database or published as policy.

Start free, no cardAll policies
Tool callverify_books
{
  "business_id": "b_9f2…"
}
Re-derived from raw postings: every entry balances · trial balance ties · accounting equation holds · no orphaned links. Run it yourself, any time.

Four rules the database enforces

Not app-code validations that a bug can skip, but constraints and revoked privileges in Postgres itself.

1

Every entry balances

Debits must equal credits to the cent, or the database rejects the write at commit. An agent (or a bug) physically cannot post books that don’t balance, which is why the trial balance always ties.
2

Postings are permanent

There is no edit and no delete, for anyone, including us: UPDATE and DELETE are revoked at the database level. Corrections post as new entries linked to the original, so history is always complete.
3

Repeats are harmless

Every posting carries an idempotency key. A network retry or a confused AI replaying a request returns the original entry; nothing posts twice. Timeouts stop being dangerous.
4

Balances are computed, never stored

Reports always derive from the postings themselves at the moment you ask, so they cannot drift from the ledger. There is no cached balance to corrupt.

The AI works inside a fence

AI assistants connect through scoped credentials: OAuth sign-ins they cannot escalate, or API keys you can make read-only. Every write lands in an append-only audit log with the actor recorded; anything that posted an entry is one click from reversed. Destructive actions like deleting transactions or accounts are human-only, in the web app.

And because the four invariants live in the database, the fence holds even against a malfunctioning agent: the worst a confused AI can do is post reversible, balanced, logged entries, which is a Tuesday, not an incident.

Append-only audit log

Every agent write: which key, which tool, what entry. One-click reverse.

Read-only keys

Reporting access with zero write surface, for analysts and cautious first runs.

Period locks

Lock a closed month and nothing posts into it, human or agent.

Human-only deletes

Destructive operations are never exposed as agent tools.

Infrastructure

Transport & sessions

All traffic is TLS (1.2+, terminated at the edge with HTTPS forced). Sessions are httpOnly cookies; the browser never holds a database credential; everything goes through the server.

Bank data

Bank credentials never touch us: Plaid handles the connection, and access tokens are sealed at rest with AES-256-GCM. Skip feeds entirely and use CSV if you prefer; the paid tier is optional by design.

Accounts & keys

Passwordless sign-in with 6-digit email codes, optional TOTP two-factor, API keys stored SHA-256 hashed and revocable at any time. You see a key once; we can never read it back.

Tenancy & backups

Row-level tenancy on every table from day one, with daily database backups. Every domain row is scoped to exactly one owner’s business.

Small attack surface

One session cookie, no ad scripts anywhere (analytics is aggregate page stats only, never your books), and a marketing site that works with cookies disabled entirely. Less machinery, less to break.

Report an issue

Security reports jump the queue: email support@ledgermcp.com with “Security” in the subject. Scope and our commitments are in the responsible disclosure policy.

Your data is yours

Export everything to CSV in one click: transactions, general ledger, chart of accounts, tags, journal, and assets. We do not sell data, run ads, or train models on your books. The business model is bank-feed subscriptions, and that is the whole of it.

The promises are written down: privacy policy, data retention, subprocessors, and the rest of the policy set.

The deepest guarantee is structural: because the free tier is the product and export is always one click, we have to earn your business every month. A ledger you can leave is a ledger you can trust; the Bench story is what the alternative looks like.

Common questions

Is it safe to let an AI write to my books?

Safer than any alternative that accepts silent mistakes. The database rejects unbalanced entries, postings are immutable, retried requests cannot double-post, and every agent write is logged append-only with a one-click reverse. The AI works inside a fence the database enforces.

Can LedgerMCP employees edit my postings?

No. UPDATE and DELETE on postings are revoked at the database level for every role, including ours. Corrections only ever happen as new, linked reversal entries, which is exactly the property accountants and auditors want.

Do you see my bank password?

Never. Bank connections run through Plaid: you authenticate directly with your bank, and we receive only the data you authorize. The resulting access tokens are encrypted at rest with AES-256-GCM and never reach the browser.

What if an API key leaks?

Revoke it in Settings: instantly dead, and a new key is free. Keys are stored SHA-256 hashed (we cannot read them back), every action a key took is in the audit log, and anything it posted can be reversed. Read-only keys limit the blast radius to zero writes in the first place.

Is my data used to train AI models?

No. LedgerMCP ships no AI and never trains on your books. Your agent’s handling of conversation data is governed by your own Anthropic or OpenAI plan, the same terms as everything else you use it for.

Where does my data live, and who processes it?

In the United States, with a deliberately short list of providers: a managed cloud database and storage provider, Plaid (bank connectivity), a cloud application hosting provider, and Resend (email). The full list with roles is published at /subprocessors, and retention schedules at /data-retention.

Trust, then verify

Start free, post a few entries, run verify_books, and read the audit log yourself.

Start free, no cardRead the docs