Security Policy

All data handled by Kleer Ledger is encrypted both in transit and at rest:

• •In transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. We do not support older, insecure protocol versions.
• •At rest: Sensitive data stored in our databases is encrypted using AES-256, an industry-standard symmetric encryption algorithm.
• •Bank credentials: Kleer Ledger never receives or stores your bank username or password. All credential handling is performed exclusively by Plaid within their secure, isolated environment.
• •Access tokens: Plaid access tokens are stored encrypted and are scoped to read-only transaction access with no payment or transfer capabilities.

Every connection to Kleer Ledger is enforced over HTTPS. We implement the following transport security controls:

• •HTTPS is enforced on all endpoints — HTTP connections are automatically redirected.
• •HTTP Strict Transport Security (HSTS) headers are enabled to prevent protocol downgrade attacks.
• •TLS certificates are issued by trusted Certificate Authorities and are rotated before expiration.
• •Weak cipher suites and deprecated TLS versions (1.0, 1.1) are explicitly disabled.

Access to Kleer Ledger systems and user data is strictly controlled based on the principle of least privilege:

• •Production database access is restricted to essential automated services only. No human operator has routine read access to raw user financial data.
• •Administrative access requires multi-factor authentication and is scoped to the minimum permissions required for the specific task.
• •User data is logically isolated per account and per organization — no user can access another user's data.
• •API endpoints enforce authentication on every request. Unauthenticated requests are rejected with no data exposure.
• •Access permissions are reviewed periodically and revoked promptly upon role changes or offboarding.

Kleer Ledger leverages a managed, enterprise-grade authentication platform with the following protections:

• •Passwords are never stored in plaintext — only secure hashed representations are retained.
• •Email-based verification is required for new account creation.
• •Session tokens are short-lived and are cryptographically signed to prevent forgery.
• •Rate limiting is applied to authentication endpoints to mitigate brute-force and credential stuffing attacks.
• •Suspicious login activity triggers additional verification requirements.

Kleer Ledger runs on modern, security-hardened cloud infrastructure:

• •Our infrastructure is hosted on cloud providers that maintain SOC 2 Type II, ISO 27001, and related compliance certifications.
• •Production environments are logically separated from development and staging environments.
• •Infrastructure is configured using infrastructure-as-code practices, reducing the risk of human configuration error.
• •Unnecessary network ports, services, and access paths are disabled by default.
• •Automated backups are performed regularly with encryption applied to all backup data.

We continuously monitor our infrastructure and application for anomalies and threats:

• •Application and server logs are collected centrally and monitored for unusual activity patterns.
• •Automated alerts are configured for error rate spikes, unauthorized access attempts, and infrastructure anomalies.
• •Uptime and availability are monitored continuously with alerting for service degradation.
• •Database query patterns are reviewed periodically to identify potential unauthorized data access.

Kleer Ledger maintains an ongoing vulnerability management program:

• •Third-party dependencies are monitored for known vulnerabilities using automated scanning tools. Critical patches are applied promptly.
• •Application code undergoes security review as part of the development process.
• •We maintain a responsible disclosure policy. If you discover a security vulnerability, please report it to support@kleerledger.com.
• •Reported vulnerabilities are triaged, prioritized by severity, and resolved in a timely manner.

Kleer Ledger integrates with a small number of carefully selected, security-certified third-party providers:

• •Plaid — A bank-grade financial data provider operating under strict financial industry security standards. Plaid is SOC 2 certified and compliant with financial data regulations. Learn more at plaid.com/safety.
• •Stripe — A PCI DSS Level 1 certified payment processor. Kleer Ledger never handles raw payment card data. All payment processing occurs within Stripe's isolated, certified environment.

We do not integrate with advertising networks, data brokers, or any services whose business model involves monetizing user data.

Security is never a finished product. Kleer Ledger is committed to continuous improvement of our security posture:

• •Security practices are reviewed and updated as the product evolves and as the threat landscape changes.
• •We monitor security advisories and industry best practices relevant to fintech applications.
• •Security considerations are embedded into our product development lifecycle from design through deployment.
• •We will update this Security Policy to reflect material changes to our security practices.

To report a security concern, contact us at support@kleerledger.com.