Security
LedgerGuard is built for sensitive contract and commitment data: tenant-scoped access, permissioned workflows, and audit-oriented product behavior. The deployment status section below summarizes configuration signals for this environment—it is not a third-party certification or independent audit opinion.
- Organization-scoped data and access
- Scoped document access with time-bounded retrieval where used
- Audit logs for important product actions
- Designed for finance-led contract and renewal workflows
Deployment security status
Checking configuration signals for this environment…
This is not a certification
LedgerGuard does not present this page as SOC 2, ISO, a penetration test, or a legal warranty. It is a product trust and deployment-status page designed to describe our controls and current operating posture.
Deployment details
Security overview
LedgerGuard is decision-support for contracts, renewals, and vendor risk. Security work centers on least-privilege access, tenant boundaries, and traceability—not on replacing your own governance, review, or procurement diligence.
How LedgerGuard handles AI
AI is used to assist extraction and review workflows. AI suggestions are not final financial decisions, and important outputs are designed to be reviewable against source contract evidence.
LedgerGuard is built so teams can verify what the system extracted, review key terms, and maintain control over contract and renewal decisions.
Tenant isolation
Data is partitioned by organization in the product model. Requests are authenticated and authorized server-side so workspace membership—not client-side routing—determines what a user can read or change.
Document access
Contract files are accessed through application-controlled, scoped retrieval paths (including time-bounded access where the product uses pre-signed URLs). Downloads and views are meant to follow workspace permissions, not anonymous links.
Auditability
Important actions are written to audit logs for review inside your workspace. Where Audit Vault is enabled, signed artifacts support internal evidence workflows—those product signals are not, on their own, an external audit opinion.
Credentials and access
Users sign in through the product’s authentication flows; roles and membership live with the tenant. Admins manage membership and access within their organization rather than sharing long-lived shared credentials for routine work.
Infrastructure and subprocessors
LedgerGuard runs on a defined set of infrastructure and service providers (for example hosting, storage, email, and observability). The subprocessors page lists the categories we use today so procurement can map dependencies.
SOC 2
LedgerGuard is in progress toward SOC 2 Type I attestation with an independent auditor. The examination covers controls at a point in time across the Trust Services Criteria that apply to our service. See the dedicated page for program status, how reports will be shared when available, and how to submit questionnaires.
Responsible disclosure
If you believe you have found a security vulnerability in LedgerGuard production services, we welcome coordinated reports so we can investigate and remediate. The dedicated page describes how to contact us, scope, and what we ask of researchers.
Security posture
We ship with operational practices you can map to your own control framework: tenant isolation in the data path, audit logs for key actions, and signed audit artifacts when that capability is configured. SOC 2 Type II remains a roadmap goal after Type I—ask for posture materials or our SOC 2 page if procurement requires structured evidence.
Need materials for procurement or security review?
We can provide posture information, subprocessors, and product trust details for active evaluations.
Security and trust inquiries
For security reviews, privacy questions, or trust-related discussions, contact us directly. Include your organization and context so we can respond quickly.
Security security@ledgerguard.io