Our Commitment to System Security and Financial Data Governance

At Ledger & Light, we understand that granting third-party access to your operational workflows (Jira) and your general ledger (Xero) requires absolute trust. Because our Agile FinOps practice bridges software development tracking and corporate financial accounting, we adhere to strict, bank-grade data governance principles.

This disclosure outlines exactly how we access, handle, process, and protect your company’s infrastructure and financial intelligence.

1. Principle of Least Privilege Access

We do not ask for, nor do we require, your root administrator credentials or master passwords.

  • Jira Instance Access: We request a dedicated, restricted user seat or API token assigned explicitly to Ledger & Light. Where possible, this is restricted to Read-Only or Project-Specific Administrator rights. We only access schema layouts, workflow parameters, and worklog data fields. We never access your proprietary source code, repositories, or intellectual property.
  • Xero File Access: Access must be provisioned via Xero’s secure invitation system using standard or advisor permissions. This access can be instantly revoked by your team at any single click of a button.

2. Zero Local Data Persistence (Data in the Path)

We do not store your corporate financial transactions or developer worklog datasets on local hardware, external servers, or personal devices.

We do not store your corporate financial transactions or developer worklog datasets on local hardware, external servers, or personal devices.

  • Live Processing: All data extraction, cleaning, and normalization occur directly within the secure memory path of your existing cloud environments (or via encrypted enterprise business intelligence instances linked directly to your architecture).
  • No Data Selling or Aggregation: Your operational metrics, employee utilization rates, software estimates, and gross profit margins are treated as strict trade secrets. We never aggregate or anonymize your data for industry benchmarking without your explicit, written corporate consent.

3. Encryption & Infrastructure Security

  • Data in Transit: All API webhooks, token exchanges, and communication pipelines utilized during our integration builds are protected by industry-standard Transport Layer Security (TLS 1.3) and end-to-end encryption.
  • Credential Storage: Any access keys or secure configuration tokens are managed strictly within encrypted, enterprise-grade credential vaults (such as 1Password) protected by hardware-token Multi-Factor Authentication (MFA).

4. Continuous Control and Revocation

Your systems remain entirely under your sovereign control.

  • Immediate De-provisioning: Upon the successful completion and sign-off of your Day 14 FinOps Audit & SOP Setup, our standard operating procedure is to guide you through the instant de-provisioning of our system seats.
  • Retainer Governance: For clients on the Agile FinOps Retainer, our access remains continuously monitored, logged, and subject to your internal corporate IT auditing policies

Professional Indemnity & Regulation

Ledger & Light operates under the strict professional code of conduct of the Association of Accounting Technicians (AAT). Our practice maintains comprehensive Professional Indemnity Insurance and is fully registered for Data Protection and AML Compliance within the United Kingdom.

If your technical lead or security officer requires a specific Data Processing Agreement (DPA) or security architecture review before onboarding, we are entirely happy to provide it.

“By submitting this form, you consent to Ledger & Light securely processing your project schema and financial parameters in accordance with our Data Handling & Privacy Disclosure to execute your FinOps configuration.”

Name