Security
It handles your financial data. We treat it that way.
Security isn't a paid add-on here. Every account — free or paid — gets the same protections, described plainly below. Everything here is implemented today.
- Mandatory MFA
- AES-256-GCM at rest
- HSTS + strict CSP
- GDPR export & deletion
Account security
Getting in is hard for everyone but you.
Mandatory two-factor
TOTP MFA is required for every account — no opt-out. Eight one-time backup codes (stored only as hashes) cover recovery.
Strong password policy
Passwords are hashed with bcrypt (cost factor 12) and must be 10+ characters with upper, lower, and a digit.
Hardened sessions
32-byte random session IDs in HTTP-only cookies, 30-day expiry, and every other session invalidated when you change your password.
Step-up admin access
Platform administration requires a fresh two-factor check every 15 minutes, separate from your normal session.
Encryption & transport
Sensitive data is sealed, in transit and at rest.
Encrypted at rest
MFA secrets are encrypted with AES-256-GCM. Backup codes are SHA-256 hashed — never stored in the clear.
Strict transport
HTTPS everywhere with HSTS (two-year max-age, includeSubDomains) so connections can't be downgraded.
Locked-down headers
A restrictive Content-Security-Policy plus X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy on every response.
Your data, your call
It's your data — leave with it whenever you want.
One-click export
Export your account and business data as JSON at any time from Settings → Account (GDPR-aligned).
Permanent deletion
Delete your account for good, with safeguards (MFA, password, and typing DELETE) to prevent accidents.
No ads, no selling
We don't sell your data, run ads, or use tracking cookies. Only essential cookies keep you signed in.
Platform hardening
Defense in depth, not a single lock.
Rate limiting
Auth-sensitive endpoints (login, signup, MFA, password reset) are rate-limited to blunt brute-force and abuse.
Input validation
Every mutating API route validates numbers, dates, strings, and emails, and enforces a JSON content type.
Audit & security logging
Admin actions are recorded in an audit trail, and security events are logged in structured form for monitoring.
Payments
Card payments are handled end-to-end by Stripe. We never see or store your card numbers — Stripe processes them and returns only the subscription status we need. Billing webhooks are verified and de-duplicated to prevent replay.
Responsible disclosure
Found something? We want to hear from you. Email security@side-ledger.com or see our security.txt. We don't claim certifications we don't hold — we'd rather show you exactly what we do.
View security.txtSecurity you can start using in minutes.
Mandatory MFA and encryption come standard — even on the free module.
No credit card to start