Security

API keys are shown to you once, at the moment of creation. What we store is a SHA-256 hash of the key, keyed by that hash. The database never holds a usable credential, so a database disclosure does not hand an attacker your keys.

Keys are scoped. An agent key can start audit runs and submit findings, but can never approve them. A full key inherits your role. That separation is enforced server-side and in the database rules, not just in the interface - the scope is immutable once written, so a machine key cannot promote itself.

An audit pack is cryptographically signed. The signature seals your compliance posture as of that date, which makes it a durable artefact rather than a screenshot of a dashboard.

Anyone holding a pack can verify it through the public verifier without a LedgerAI account and without uploading the pack to us. Verification confirms the pack is authentic and untampered. This is deliberate: evidence that only we can vouch for is not evidence, it is a dependency.

The org-audit agent runs against your systems and reports findings back. It passes candidate content through a redaction layer at the sovereignty boundary before anything leaves, so personal data encountered while scanning does not ride along into a finding.

That boundary is covered by tests that assert the invariant directly, rather than being a claim in a document. If the redactor stops redacting, the build fails.

Authentication is handled by Firebase Authentication, including Sign in with Apple and Google. We never see your password.

Workspace data is partitioned by account, and database rules enforce that a signed-in user can read and write only their own organisation’s records. Role-based access control governs what each member of a workspace may do, including who may approve audit findings.

Traffic is served over TLS. Our infrastructure providers encrypt data at rest.

LedgerAI is a young product. We would rather be precise about that than imply certifications we do not hold.

• We do not currently hold a SOC 2 or ISO 27001 certification of our own.
• We do not currently offer a contractual uptime guarantee.
• We do not offer data residency guarantees; our providers operate globally.
• We have not undergone an independent third-party penetration test.

If you find a security flaw, email vuyo@quantyx.co.za with enough detail to reproduce it. We will acknowledge receipt, keep you updated while we work on it, and credit you when it is fixed if you want the credit.

Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and please do not access, modify or delete data belonging to anyone else while investigating. We will not pursue action against researchers who act in good faith within those limits.