Security

Books that protect themselves

Letting an AI keep your books only works if the ledger cannot be corrupted. Here is exactly how LedgerMCP guarantees that.

Start free, no cardAll policies
Tool callverify_books
{
  "business_id": "b_9f2…"
}
Re-derived from raw postings: every entry balances · trial balance ties · accounting equation holds · no orphaned links. Run it yourself, any time.

Four rules the database enforces

Not app-code validations that a bug can skip, but constraints and revoked privileges in Postgres itself.

1

Every entry balances

Debits must equal credits to the cent, or the database rejects the write at commit. An agent (or a bug) physically cannot post books that don’t balance, which is why the trial balance always ties.
2

Postings are permanent

There is no edit and no delete, for anyone, including us: UPDATE and DELETE are revoked at the database level. Corrections post as new entries linked to the original, so history is always complete.
3

Repeats are harmless

If the same action gets sent twice, a network hiccup or an AI repeating itself, it is only recorded once. Nothing is ever double-counted, so timeouts stop being dangerous.
4

Balances are computed, never stored

Reports always derive from the postings themselves at the moment you ask, so they cannot drift from the ledger. There is no cached balance to corrupt.

The AI works inside a fence

AI assistants connect through scoped credentials: OAuth sign-ins they cannot escalate, or API keys.

The fence holds even against a malfunctioning agent: the worst a confused AI can do is post reversible, balanced, logged entries, which is a Tuesday, not an incident.

Append-only audit log

Every agent write: which key, which tool, what entry. One-click reverse.

Read-only keys

Reporting access with zero write surface, for analysts and cautious first runs.

Period locks

Lock a closed month and nothing posts into it, human or agent.

Human-only deletes

Destructive operations are never exposed as agent tools.

Infrastructure

Transport & sessions

All traffic is TLS (1.2+, terminated at the edge with HTTPS forced). Sessions are httpOnly cookies; the browser never holds a database credential; everything goes through the server.

Bank data

Bank credentials never touch us: Plaid handles the connection, and access tokens are sealed at rest with AES-256-GCM. Skip feeds entirely and use CSV if you prefer; the paid tier is optional by design.

Accounts & keys

Passwordless sign-in with 6-digit email codes, optional TOTP two-factor, API keys stored SHA-256 hashed and revocable at any time. You see a key once; we can never read it back.

Tenancy & backups

Row-level tenancy on every table from day one, with daily database backups. Every domain row is scoped to exactly one owner’s business.

Small attack surface

One session cookie, no ad scripts, aggregate-only page analytics, and a marketing site that works with cookies disabled entirely. Less machinery, less to break.

Report an issue

Security reports jump the queue: email support@ledgermcp.com with “Security” in the subject. Scope and our commitments are in the responsible disclosure policy.

Your data is yours

Export everything to CSV in one click: transactions, general ledger, chart of accounts, tags, journal, and assets. We do not sell data, run ads, or train models on your books. The business model is bank-feed subscriptions, and that is the whole of it.

The deepest guarantee is structural: because the free tier is the product and export is always one click, we have to earn your business every month. A ledger you can leave is a ledger you can trust; the Bench story is what the alternative looks like.

The promises are written down: privacy policy, data retention, subprocessors, and the rest of the policy set.

Common questions

Is it safe to let an AI write to my books?

Safer than any alternative that accepts silent mistakes: the database rejects unbalanced entries, postings cannot be edited or deleted, and every agent write is logged with one-click undo.

Can LedgerMCP employees edit my postings?

No. UPDATE and DELETE on postings are revoked at the database level for every role, including ours; corrections post only as new, linked reversal entries.

Do you see my bank password?

Never. Bank connections run through Plaid: you authenticate directly with your bank, and we receive only the data you authorize.

What if an API key leaks?

Revoke it in Settings: instantly dead, and a new key is free. Read-only keys limit the blast radius to zero writes in the first place.

Is my data used to train AI models?

No. LedgerMCP never trains on your books; your agent’s handling of conversation data is governed by your own Anthropic or OpenAI plan.

Where does my data live, and who processes it?

In the United States, with a deliberately short list of providers: a managed cloud database and storage provider, Plaid (bank connectivity), a cloud application hosting provider, Resend (email), and the AI model provider that powers the optional built-in assistant. The full list with roles is published at /subprocessors, and retention schedules at /data-retention.

Trust, then verify

Post a few entries, run verify_books, and read the audit log yourself.

Start free, no cardRead the docs