Security and data protection
Your purchase register says a lot about your business.
Who you buy from, at what price, how late you pay. We keep it in India, encrypt it, limit who can see it and log every time someone does. This page says exactly how, including what is not finished yet.
- Data residency
- AWS Mumbai, ap‑south‑1 Live since 2023
- ISO/IEC 27001:2022
- Certified Surveillance audit due Mar 2027
- SOC 2 Type II
- Audit in progress Observation window to Mar 2027
- DPDP Act 2023
- Processor terms and rights workflows In every contract
Where your data lives
Everything stays in India. No analytics copies abroad, no offshore support access.
- Primary region
- AWS Asia Pacific (Mumbai), ap-south-1, across three availability zones.
- Backups
- Encrypted snapshots every 6 hours to AWS Hyderabad, ap-south-2. Kept 35 days.
- Encryption
- AES-256 at rest with keys in AWS KMS, rotated yearly. TLS 1.2 or higher in transit.
- Separation
- Each workspace is isolated at the database row level and checked on every query. CA clients never see each other.
- Recovery
- Recovery point under 6 hours, recovery time under 4 hours. Restore drills every quarter.
DPDP Act 2023
Your purchase data includes personal data: proprietors’ names, phone numbers, sometimes PANs. Under the Act you are the Data Fiduciary and Ledgerline is your Data Processor.
- Processing terms
- A data processing agreement is part of every subscription. We use your data only to deliver the service.
- Supplier messages
- WhatsApp reminders go only to numbers from your own books, with an opt-out in every message that we honour within 24 hours.
- Rights requests
- Access, correction and erasure requests are handled in-app. Erasure on contract end within 30 days, confirmed in writing.
- Breach notice
- We tell you within 24 hours of confirming a breach, with what we know, so you can meet your duty to the Data Protection Board of India.
- Grievance officer
- Nandini Rao, grievance@ledgerline.in. Acknowledged within 2 working days.
GST portal access
The question CA firms ask first.
- No passwords stored
- We never ask for or keep your GST portal password.
- Through a GSP
- Portal data comes through a GST Suvidha Provider licensed by GSTN, over its API.
- OTP consent
- You enable API access on the portal and approve it with an OTP. Access expires on its own, and you can revoke it from the portal at any time.
- Read first
- Ledgerline only reads returns. IMS actions are sent only after a user with filing rights confirms them.
Role-based access
Five roles. Nobody sees more than their job needs.
Roles are set per workspace, so an article assistant can be a preparer for one client and have no access to another. Custom roles on Growth and CA Firm.
| Permission | Owner | Partner | Accountant | Article assistant | Auditor |
|---|---|---|---|---|---|
| View reconciliation | |||||
| Accept or reject matches | |||||
| Send supplier reminders | |||||
| Push IMS actions to portal | |||||
| Export data | |||||
| Manage users and billing | |||||
| View audit log |
AllowedAssigned clients, or with approvalNot allowed
Audit log
Every click that changes a number is written down.
Who matched what, who sent which reminder, who exported data and from where. Kept for eight years, the same as your GST records, and exportable for your statutory auditor.
- Append-only, cannot be edited by anyone at Ledgerline
- Sign-in with Google, Microsoft or email OTP, with two-factor for owners
- Sessions end after 12 hours, or on IP change for CA Firm
Sub-processors
The companies that touch your data on our behalf. We give 30 days’ notice before adding one.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, backups, email delivery | Mumbai and Hyderabad |
| Meta WhatsApp Business Platform | Supplier reminder messages | Message content only, no books data |
| Licensed GST Suvidha Provider | GST portal API access | India |
| RBI-authorised payment aggregator | Subscription billing | India |
Found a problem?
Responsible disclosure, in plain terms.
- Report to
- security@ledgerline.in. We reply within 2 working days and keep you updated until it is fixed.
- Safe harbour
- Good-faith research on your own test workspace will not be met with legal action.
- Security pack
- ISO 27001 certificate, latest penetration test summary (August 2026) and our DPA template, on request under NDA. Ask for it