How your data is handled

If you are a CPA firm, you are required to ask this

A tax practice is a financial institution under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies to it. 16 CFR §314.4(f) requires you to take reasonable steps to select providers “capable of maintaining appropriate safeguards”, to require them by contract to implement and maintain those safeguards, and to assess them periodically. §314.4(c) requires encryption in transit and at rest, and multi-factor authentication for anyone reaching the system.

That is not a formality we are decorating. It is the reason this page is a list of facts rather than a paragraph of reassurance: you cannot discharge that duty against a vendor who will not tell you what happens to the file.

What is held

The documents you send. The file as it arrived, and the figures read out of it, with the sentence each figure came from so you can check the reading against the page. We collect these tax and accounting documents strictly for the purpose of organizing your client checklist, extracting tax figures into workpapers, and retaining the audit trail for the return.
What you told us about your clients. Names, entities, the structure you set up, and what each company is, along with contact details (email, phone, postal address) and encrypted taxpayer identifiers (SSNs and EINs). We collect this client and entity data for the purpose of identifying each taxpayer, matching incoming documents to the right engagement, delivering portal and filing-status notifications, and preparing tax workpapers.
Sign-in details. An email address, and the second factor if you have set one up (plus billing and payment details handled through Stripe when a firm subscribes). We collect sign-in and account details for the purpose of authenticating authorized users, enforcing multi-factor security under 16 CFR §314.4(c), recording the firm activity log, and administering subscription billing.

Where it runs, and who else touches it

Named individually, because “industry-standard providers” is not something a firm can assess under §314.4(f).

DigitalOcean: the servers, the database and the stored documents, in the United States. Uploaded files are held in DigitalOcean Spaces.
Anthropic: Read this one. The reader tries to name a page locally first and only asks an outside model about pages it cannot name itself. When that happens the page is sent out. That reaches lease text, document pages and prior returns, which is taxpayer data, and it is the thing to weigh before you send a client file.
Amazon Web Services: the email we send: sign-in links, reminders, and what you ask us to send a client. Delivered through Amazon SES.
Twilio: text messages, where a firm has turned them on.
Stripe: payment details, which reach Stripe and are not stored here.

What is encrypted, and how you sign in

In transit: every connection is HTTPS.
Social security numbers are encrypted in the database with a key held only in the server environment, never in the database beside them.
There is no password by default. Signing in is a code sent to your email, and an authenticator app can be added on top. That is the multi-factor authentication §314.4(c) asks for.

How long documents are kept

Seven years past a return’s filing deadline is the default retention period for every firm, which is the ordinary professional standard. Each firm owner can change its retention period (between 3 and 25 years) or clear it to keep records indefinitely (nothing is deleted when a firm clears its retention limit), and documents entering their 90-day pre-destruction grace window stay visible on the retention schedule so the firm can place a hold on basis or carryover records before anything is removed.

What we do not do

There is no analytics or advertising tracker on these pages. Measured, not asserted: zero third-party scripts on the public site.
Client data is not sold, and it is not used to advertise.
We do not keep your books. There is nobody doing the work overnight. It is software you run.

Your rights to access, correct, or delete your data

Every individual whose information is held in Ledgerly has the right to access, the right to correct, and the right to delete their personal and tax data:

Right to access: Firm owners and authorized staff can view and export all client records, documents, and activity logs at any time from the Clients page, Engagement binder, or Firm Settings archive export. Clients can view and download their own uploaded documents and return records directly in their client portal, or ask their CPA firm for a complete copy.
Right to correct: Firm staff can update or correct client names, contact details, entity structures, and extracted figures directly on the client profile or engagement review screen. Clients can update their contact details in the portal or ask their firm (or email support@myledgerly.ai) to correct any inaccurate record.
Right to delete: Firm owners can delete individual documents or entire client records from the client profile or Firm Settings (subject to the 60-day recovery window before permanent destruction of database rows and stored files). Clients who wish to exercise their right to delete their records may request deletion through their CPA firm or by writing to support@myledgerly.ai or security@myledgerly.ai.

Security incident notification (72-hour commitment), subprocessors, and FTC Safeguards Rule (16 CFR Part 314 / IRS Pub. 4557)

For CPA firms and tax practices regulated under the FTC Safeguards Rule (16 CFR § 314.4(f) and § 314.4(j)) and IRS Publication 4557, REVDB LLC commits to notify the affected firm within 72 hours of discovering any confirmed security incident or unauthorized disclosure of customer information held on the firm’s behalf. Security inquiries and vulnerability reports can be sent directly to security@myledgerly.ai. Named subprocessors are DigitalOcean LLC (US infrastructure and storage), Amazon Web Services Inc. (AWS SES email delivery), Twilio Inc. (consent-gated transactional SMS), Stripe Inc. (subscription billing), and Anthropic PBC (PII-redacted document extraction with zero training retention). Upon contract termination, firms may export all records before permanent deletion under their retention schedule.

What is not settled yet, said plainly

The alternative was to fill these in with something comfortable, which is the failure this whole page exists to avoid.

The legal entity, its jurisdiction, and a postal address for notices.
A data processing agreement a firm can sign, which is what §314.4(f)’s “by contract” actually means. If you need one to proceed, say so and it moves up the list.
A formal privacy policy reviewed by counsel. This page describes what the software does; it is not that document, and it does not pretend to be.

Ask and you will get a straight answer, including “we have not done that yet”.