Security
Security
How your account is protected, what this service does and does not hold, and how to tell us if you find something wrong. Written plainly, and limited to what is actually true today.
What LedgerTouch does not hold
The single most useful thing to know about this service is what is absent from it. LedgerTouch does not connect to your bank, broker or exchange. There is no open-banking integration and no brokerage linking, so the service never holds your banking credentials, never has permission to move money, and cannot place a trade on any account you own.
Holdings and transactions are entered by you, and describe positions rather than granting access to them. If this service were fully compromised, the attacker would learn what a portfolio contains. They would not be able to withdraw from, trade in, or log in to any account at a bank or broker.
Signing in
Authentication is handled by Google Firebase Authentication. Passwords are never stored by LedgerTouch in any form; the sign-in process is delegated to Firebase, which stores only a salted hash.
Two-factor authentication
Two-factor authentication is available in two forms: a code from an authenticator app (TOTP), and a code sent by SMS. An authenticator app is the stronger of the two, because SMS can be intercepted by someone who takes over your phone number. If you enrol both, the authenticator app is preferred at sign-in.
Re-verification on sensitive actions
Some actions ask you to verify again even though you are already signed in — changing your password or email, enrolling or removing a second factor, and changing billing. This limits the damage an unattended, already-signed-in browser can do.
Session history
Recent sign-ins are listed in your account settings so you can see sessions you do not recognise. If you find one, change your password and enrol an authenticator app.
How data is stored and moved
Portfolio data is stored in Google Cloud Firestore and is encrypted at rest by Google Cloud. All traffic to and from the site travels over HTTPS; the site is served by Firebase Hosting, which terminates TLS. Access rules are enforced server-side so that a signed-in account can read and write only its own records, rather than relying on the browser to police that boundary.
Payments are handled by Stripe. Card numbers are entered directly into Stripe's own hosted fields and are never sent to, processed by, or stored on LedgerTouch servers.
Advertising and the signed-in workspace
No advertising runs inside the signed-in portfolio workspace, and no information about your holdings, transactions or account is ever used to select an advertisement anywhere on this site. See the cookie policy for what the public blog sets and how to refuse it, and the privacy policy for what is collected and why.
Reporting a vulnerability
If you believe you have found a security problem, please email security@ledgertouch.com with enough detail to reproduce it. Please report it privately first rather than disclosing it publicly, and give us a reasonable opportunity to fix it.
We will acknowledge a report within five working days. This is a small service and there is no paid bug bounty, but genuine reports are taken seriously, fixed, and credited if you would like to be.
Honest limits
LedgerTouch is operated by a small team and has not undergone an independent penetration test or a formal certification such as SOC 2 or ISO 27001. We would rather say that plainly than imply an assurance that has not been earned. The design decision that does most of the work here is the first section on this page: the service is deliberately built so that it never holds the credentials that would make it worth attacking.