The short version
Your records are yours alone. Every piece of your data is protected by row-level security, meaning the database itself enforces that only you can read or change your records — not other users, not by accident. Data is encrypted in transit and at rest, hosted on established cloud infrastructure, and you can export or delete everything at any time.
Data isolation (row-level security)
This is the most important safeguard, so it goes first. LoonieLedgr is built on a database with row-level security (RLS) enabled on every table holding your data. RLS means the isolation rule isn't just enforced by our application code — it's enforced by the database engine itself. Every query is automatically constrained to the rows belonging to the authenticated user. Even if there were a bug in the app, the database would still refuse to return another user's records. One creator can never see another creator's books.
Encryption
Data is encrypted in transit using HTTPS/TLS — everything between your browser and our servers travels over an encrypted connection. Data is also encrypted at rest on the underlying storage, so the stored database files are protected. Sensitive credentials (like the keys used to connect to platforms) are held server-side as secured secrets and are never exposed to your browser.
Access & authentication
Access to your account is protected by authenticated sign-in. Passwords are never stored in plain text — authentication is handled by a dedicated auth system that stores only securely hashed credentials. We enforce a minimum password strength, and sessions are managed with secure tokens that expire. Privileged operations (like server-side data processing) run with credentials that never touch the browser.
Infrastructure
LoonieLedgr runs on established, reputable cloud infrastructure rather than self-managed servers. The database, authentication, and server-side functions are provided by a managed platform with its own security program; the website is served over a global content network with automatic HTTPS. This means we benefit from infrastructure-level protections — patching, network security, and physical data-centre security — maintained by specialists.
Data location
We store your data with Canadian privacy law in mind. For details on retention periods, sub-processors, and cross-border handling, see our Privacy Policy, which covers your rights under PIPEDA and Quebec's Law 25.
Your control over your data
You can export your data at any time, and you can request complete deletion by emailing privacy@loonieledgr.ca. We also limit what we take in: LoonieLedgr only ingests your financial data from your signup date forward unless you explicitly opt into a historical catch-up — so we never hold more of your history than you've asked us to.
Reporting a security issue
If you believe you've found a security vulnerability, we want to hear about it. Please email security@loonieledgr.ca with the details. We'll acknowledge your report and work to address legitimate issues promptly. Please don't publicly disclose an issue until we've had a chance to address it.
A note on honesty. LoonieLedgr is an independent product built by a CPA, not a large enterprise with a compliance department. We've built security in from the foundation — real isolation, real encryption, reputable infrastructure — and we describe it plainly rather than dressing it up. If a security practice matters to you and isn't covered here, just ask.