Security, in plain terms. This page lists only what is in place today.
Practice Ledger is served over HTTPS only, using TLS 1.2 or 1.3. Older versions are refused, and browsers are told to always use a secure connection.
Passwords are stored as bcrypt hashes, never in plain text.
Sign-in attempts are rate limited, and an account locks for 15 minutes after 10 failed attempts.
Each firm's data is isolated from every other firm's, and that separation is tested in both directions on every release.
Five roles: Admin, Partner, Manager, Staff and Viewer. What each person can see and do is enforced on the server, not just hidden on the screen.
Every change is recorded, and our own administrative actions have their own audit log.
Closed months can't be changed by time, expenses, adjustments, voids or imports. Every lock and reopening is recorded with a reason.
We set up each firm, and your admin adds your users. When our team needs to see your account to help you, that access is monitored.
The software computes every figure. AI text that contains a number of its own is refused.
Two-factor sign-in isn't available yet. It depends on email, which isn't connected today. See Where Practice Ledger is headed.
Have a security question we haven't covered? Book a demo and ask us. We'll answer plainly, including what isn't in place yet.
Book a demo and bring your security questions.