01
Passwords stay protected
Passwords are stored only as salted, memory-hard hashes, never plain text.
Your records.
Handled with care.
Practical protections, explained in plain language.
BUILT INTO YOUR WORKSPACEPractical protection.
Practical protection.
Clear by design.
How Daily Ledger protects passwords, sessions and the records in your account.
02
Sessions and request protection
Session cookies are HttpOnly and secure. No sign-in token is stored in local storage. Actions use CSRF protection.
03
Safer sign-in
Sign-in and verification attempts have rate limits and lockouts. Signup verification codes allow 5 attempts and expire after 5 minutes.
04
Account recovery
Password-reset links are single-use and short-lived.
05
Separate accounts
Data is isolated per account. Administrator access is limited to one controlled account with audit logging.
06
Hosting and payments
The app frontend runs on Vercel, with its API and PostgreSQL on Railway, over HTTPS. When payments launch, a third-party processor will handle card details; full card numbers do not touch our servers.
Found a vulnerability?
Report it privately to dailyledger001@gmail.com or support. Include enough detail to help us reproduce the issue, without sharing anyone else’s data.
Clear about our claims.
We do not claim certifications we do not hold. No system is perfectly secure. Use a strong, unique password and tell us if you suspect a problem.