You are handing us your contracts. Here is how they are held.

Every business record in LedgerLock — invoice, contract, field ticket, finding, document, audit event — carries the identifier of the organization that owns it, and is indexed on it.

Scoping is written explicitly at every query, not applied invisibly by a framework hook. Magic that adds a tenant filter for you is magic that can silently stop adding it. An explicit clause is one that a reviewer can grep for and a test can assert on.

Server code enters through a single session gate that resolves the caller's organization and role before any data is read. There is no path that reads a record first and checks ownership afterwards.

All traffic is served over TLS. HTTP requests are redirected, and the application is only reachable over HTTPS.

Data at rest — the database and uploaded documents alike — is encrypted by the underlying managed platforms using AES-256.

Secrets and connection strings live in the deployment platform's encrypted environment store. They are not committed to the repository and are not readable from the client.

Invoices, tickets, contracts, and receipts are the most sensitive things you give us, so they are stored privately and are never publicly addressable. There is no guessable URL that returns one.

A document is served only to an authenticated member of the owning organization, through a short-lived link generated for that request. The link expires; a copied URL stops working.

Deleting a document deletes the stored object, not just the row that points at it.

Access is role-based across seven roles — Admin, Controller, AP Analyst, Ops Manager, Procurement, Executive, and Auditor — each mapped to an explicit set of capabilities.

The map is a flat matrix, small enough to read in one screen, and the settings page renders it verbatim so an administrator can answer “what can a Controller actually do?” without guessing. Approving payment, dismissing a finding, and managing members are separate capabilities held by different roles.

Auditor is read-only by construction, including read-only on the audit log. Nobody is granted a capability because it was convenient during a support conversation.

Every meaningful action — an approval, a hold, a dismissed finding, a rate change, a member added — writes an event inside the same database transaction as the change itself. If the change lands, so does its record.

Events are append-only and hash-chained: each one carries the hash of the event before it. Nothing updates an audit event and nothing deletes one.

That chain is the point. Altering or removing a past event breaks every hash after it, which makes tampering detectable rather than merely discouraged — including tampering by an administrator, and including by us.

You own your data. Findings, decisions, and audit history are exportable for the life of the account.

We delete customer documents and records on request. Deletion is real deletion of the stored objects, not a hidden flag, and it propagates to backups on the platforms' standard backup rotation.

If you close your account we do not retain your documents as a matter of course. Tell us what you want kept and for how long, and that is what happens.

Your invoices, contracts, rates, vendor names, and findings are never used to train or fine-tune any model — ours or a vendor's. There is no setting to check, because there is no such use.

Where AI reads a messy document or drafts an explanation, it operates on your data to answer your question and for nothing else. It never approves a payment, never produces a score without a stated reason, and never sends a vendor a message on its own.

Your commercial terms with your vendors are the most confidential thing in an AP department. They are not training material.