Trust and security — Ledger

The security work is already done. Here is the paperwork.

Ledger runs on the same posture the biggest teams need on day one. If your security team asks for it, it is likely on this page or on our trust portal.

Get SOC 2, ISO 27001, and pen test reports sent to your inbox.

Certifications and frameworks

SOC 2
Type II, annual audit
ISO 27001
Certified since 2024
GDPR
DPA on request
HIPAA
BAA available
CCPA
Compliant, opt out honored
PCI DSS
Level 1 via Stripe

How we protect your data

D

Data protection

  • ✓ AES 256 encryption at rest for every record
  • ✓ TLS 1.3 in transit, HSTS enforced
  • ✓ Field level encryption for sensitive columns
  • ✓ Customer managed keys on enterprise plans
  • ✓ Data residency in US, EU, and APAC regions
I

Infrastructure

  • ✓ Multi region deployment on AWS
  • ✓ Fully isolated tenant databases
  • ✓ Zero downtime deploys, rollback in under a minute
  • ✓ 24 by 7 security operations center
  • ✓ Quarterly third party penetration tests
O

Operations

  • ✓ Least privilege access, reviewed monthly
  • ✓ Mandatory MFA and hardware keys for all staff
  • ✓ Background checks for anyone with prod access
  • ✓ Incident response plan tested twice per year
  • ✓ Vendor security reviews on a rolling basis

All systems operational.

Operational

Trailing 90 day uptime across the API, dashboard, and warehouse sync.

API
99.99%
Operational
Dashboard
99.98%
Operational
Warehouse sync
99.97%
Operational
Webhooks
99.99%
Operational

Sub-processors

VendorPurposeData locationDPA
Amazon Web ServicesCompute, storage, databaseUS, EU, APACOn file
SnowflakeWarehouse and analyticsUS, EUOn file
StripeBilling and payment processingUSOn file
SegmentProduct analytics eventsUSOn file
DatadogApplication performance monitoringUSOn file
TwilioTransactional email and SMSUSOn file

Need the full documentation?

Get SOC 2 reports, ISO 27001 certificate, penetration test summaries, and our security whitepaper sent to your inbox.

Sent within one business day. NDA optional.
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon
© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon© BrowserMoon