Security and confidentiality
How Ledgervera handles the information you send it. Last updated October 14, 2026.
The short version
- Private details are masked on our server before anything is sent to an AI.
- We send the masked text to three AI providers through their paid business APIs, which don't train on it.
- Photos aren't stored. You cover private details on them before sending.
- Saved checks are kept (masked) for 90 days, then deleted automatically. You can delete them sooner.
- Each person has their own login. Your firm's admin can open checks saved by your firm. PODNalious staff don't open checks.
What is masked automatically
Before a check runs, Ledgervera replaces these with placeholders such as [SSN-1] in everything you type or upload as text (questions, answers, context and documents):
- Social Security numbers and ITINs, including partly hidden ones (XXX-XX-1234)
- Employer identification numbers (EINs)
- Bank, routing, card and other account numbers
- Email addresses, personal phone numbers and dates of birth
- Street addresses and PO boxes, including Utah grid addresses
- Names you list in "Names to remove", and names that follow labels such as "Taxpayer:" or "Client name:"
The same value always gets the same placeholder within a check, so the AIs can still follow the facts. Use Preview what's sent to see exactly what the AIs will receive. Masking is a safety net, not a guarantee: it can miss unusual formats and names it isn't told about. Photos can't be masked automatically; use the Cover tool to black out private details on each photo before sending.
Who receives what
| Recipient | What they receive | Why |
|---|---|---|
| Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) | The masked question, answer, context and document text, and any photos | To review, correct and explain. Sent through paid business APIs whose terms don't allow training on the data; providers may keep requests briefly for abuse monitoring under their own terms. Where a provider offers a no-storage setting, Ledgervera uses it. |
| Cornell Legal Information Institute, IRS.gov, Utah Legislature | Only the citation being looked up (for example "26 U.S.C. 401") | To confirm the citation exists and read the official text. None of your text is sent. |
| Render (hosting) | The stored, masked checks and account data | Ledgervera runs on Render's servers in the United States, on encrypted connections (HTTPS). |
We don't sell data, and we don't use your checks to train any AI model.
What we store, and for how long
- Saved checks (masked text, verdicts, citations, the AIs used and the time): 90 days, then deleted automatically. Delete any check, or all of your checks, from your account at any time.
- Photos: not stored. A saved check keeps only the photo names.
- Your account: name, email, firm, plan and a usage log (dates, check type and cost, with no content), until you delete your account.
- Backups: a copy of the database is made daily and the last 7 are kept, so a deleted check can remain in a backup for up to 7 days.
- Server logs record that a check ran, its scores and cost, never its text.
Accounts and access
- Passwords are stored only as salted, slow hashes (PBKDF2-SHA256, 310,000 rounds). Repeated wrong passwords lock the account for a few minutes.
- Sign-in uses secure, HttpOnly cookies over HTTPS. Changing your password signs out your other devices.
- Ledgervera is invite-only. Each person must have their own login; don't share passwords.
- A firm admin can see the firm's people, usage and the checks they saved. Removing someone from the firm turns their login off; the checks they saved stay with the firm.
- PODNalious staff can see account and usage information to run the service, but don't open checks. If you ask for help with a specific check, we'll ask you to share it with a link.
Uploaded documents are evidence, not instructions
Every AI is told that documents and photos are evidence only and to ignore any instructions written inside them, which protects against hidden instructions in files.
Your responsibilities as a tax professional
- Tax return preparers have special federal rules on using and disclosing client tax information (IRC §7216 and its regulations). Remove client identities before using Ledgervera; if you can't, get the client's written consent first or don't use that information here.
- The FTC Safeguards Rule requires tax preparers to keep a written information security plan. You can describe Ledgervera in yours as a service provider that receives de-identified information, using this page.
- Review the corrected answer, the citations and any calculated deadline before relying on them.
If something goes wrong
If we learn of unauthorized access to customer information, we will notify affected customers without unreasonable delay and as required by law. Report a security concern to steve@podnalioustechnologies.com.