Ledgy has a dedicated team with regular involvement from senior leadership to oversee information security. Responsibilities of the team include defining policies, enforcing security practices, and monitoring overall security.

A structured program for ongoing identification, measurement, and management of IT-related risks is in place and overseen by relevant personnel and senior leadership.

Responsibilities for processing personal data are clearly defined in line with security policies.

Ledgy maintains registers of IT resources used for personal data processing, including hardware, software, and network. Designated personnel are responsible for maintaining and updating the registers.

• Incident procedures are in place to ensure effective responses to security incidents, including those involving personal data.
• Ledgy promptly reports any security incident leading to the loss, misuse, or unauthorized access to personal data to affected data controller(s).

Ledgy has established procedures and controls to ensure the required level of IT system continuity and availability for processing personal data in case of an incident or data breach.

• Multiple Availability Zones to provide improved redundancy and fault tolerance.
• Periodic Disaster Recovery and/or Business Continuity exercises are conducted.

Ledgy verifies and validates all candidates prior to hiring, including background checks, to assess their suitability and manage risk.

Ledgy ensures that all employees understand their responsibilities and obligations regarding personal data processing and compliance with security policies.

Ledgy maintains clear procedures for management of access rights for new joiners and during termination. Processes are also defined for transferring rights and responsibilities during internal reorganizations or other changes in employment.

Ledgy trains employees about security controls and requirements relevant to their work. Employees are regularly educated on data protection requirements and legal obligations through awareness campaigns and monthly training on general security topics.

Access control rights are specifically assigned to roles involved in personal data processing, following the principle of least privilege. Access is granted following the "need-to-know" principle to limit access to personal data to those who require it. Periodic reviews of all access levels are conducted.

An access control system applicable to all IT system users is implemented, allowing for user account creation, approval, review, and deletion. Multi-factor authentication (MFA) is enforced where possible.

The use of common user accounts is prohibited, and if necessary, users with common accounts have the same roles and responsibilities.

Where passwords are used, they are required to be at least 16 characters long, meet strong password control parameters (length, complexity, non-repeatability), and are never transmitted over the network unprotected.

Log files are enabled for systems and applications used in personal data processing, tracking data access (view, modification, deletion) and other security and system events.

Ledgy has implemented comprehensive logging and monitoring mechanisms to track data access and system activities. Ledgy personnel also perform periodic reviews and analysis of logs to identify and mitigate security incidents and anomalies.

Database(s) and application servers run in separate environments and separate systems to ensure data protection. Personal data is only processed as required to fulfill the service’s intended purpose.

Database access is highly restricted to database administrators and only granted on a need-to-know basis.

Stored personal data is only stored in cloud storage where secure deletion assurance is provided by the cloud hosting provider. Policies are in place prohibiting the storage of personal data on paper or local drives to prevent data loss through these methods.

Stored data is encrypted at rest using AES-256. When accessed through the Internet, communication is encrypted using TLS 1.2 or better.

Ledgy manages a backup/snapshot service hourly, which is tested periodically. Backup and data restore procedures are defined, documented, and linked to specific roles and responsibilities.

Network traffic to and from the IT system is monitored and controlled using firewalls and/or security groups and other network security technologies. A Web-Application Firewall (WAF) is used to monitor web traffic and help prevent abuses.

The production service environment is divided into multiple zones and VPCs depending on the security requirements of individual services.

Ledgy adheres to a structured Software Development Lifecycle (SDLC) throughout its software and system development practices. Security is integrated throughout the phases of the development lifecycle.

Ledgy ensures that IT system changes are recorded and monitored by designated personnel, subjected to appropriate testing, and approved prior to release.

Software, system components, and 3rd party dependencies are subjected to regular reviews to proactively identify and track potential security vulnerabilities, which are then tracked until addressed.

System components are subjected to periodic and ongoing security testing, including penetration tests, security scans, and code analysis. Findings are tracked until addressed.

Ledgy hosts all Customer Data in Google Cloud Platform (GCP). Ledgy regularly reviews Google’s physical and environmental controls for relevant data centers, as audited by Google’s third-party auditors. Such controls include, but are not limited to:

• Physical access to the facilities is controlled at the building ingress points;
• Visitors are required to present ID and sign in;
• Physical access to servers is managed by access control devices;
• Physical access privileges are reviewed regularly;
• Facilities utilize monitor and alarm procedures;
• Fire detection and protection systems;
• Power back-up and redundancy systems; and Climate control systems.