Security

We design Lekha for controlled access and operational traceability from day one. Last updated 2026-06-10.

Tenant isolation

Every request is scoped by tenant. Cross-tenant access is blocked by policy and returns 404, not 403, so existence of records in other tenants is not disclosed.

Role-based access controls

Owners, staff, and accountants are permission-scoped. Free-plan tenants are read-only unless moved to paid by an admin. Admin write-mode is time-boxed to a 30-minute window per session.

Document-confirmation workflow

Captured document fields stay as draft suggestions until a user explicitly confirms them into the ledger. AI-assisted extraction is probabilistic and never auto-posts to financial records.

Auditability

Every CREATE / UPDATE / DELETE on every entity writes an audit row capturing actor, timestamp, and before/after values. Audit log is queryable from the in-app Settings panel and retained for the lifetime of the tenant.

Encryption

Encryption at rest: AWS-managed AES-256 on every database volume and S3 bucket. Encryption in transit: TLS 1.2/1.3 with HSTS. Tenant-managed secrets (SMTP credentials, e-invoice GSP credentials) are envelope-encrypted at the application layer with AES-256-GCM.

Authentication

Passwords hashed with argon2id. TOTP MFA available on every account with recovery codes generated at enrollment. Refresh tokens rotate; sessions are revocable from the in-app session list.

Resilience and recovery

Point-in-time recovery (PITR) on the production database with 30-day retention.
Database recovery point is approximately 5 minutes via PITR transaction logs; uploaded document files are durable to the last successful write to S3 (Mumbai region).
A documented restore procedure is maintained for full-loss recovery.

Sub-processors

The authoritative list of the third parties that process customer data on our behalf — with the data each one touches and the country it operates from — is published at /subprocessors. Subscription payments use no payment processor: they are paid by direct bank transfer (UPI / IMPS / NEFT) and we never handle card details.

Compliance posture

DPDP-2023 compliance documented at /dpdp; grievance officer designation on the same page.
SOC 2 Type II and ISO 27001 attestations are not currently in scope.

Policy pages

See our Privacy Policy, Terms and Conditions, DPDP-2023 disclosure, and cookie policy.

Responsible Disclosure

To report a vulnerability, email lekha@ekarche.com. Our public disclosure file is available at security.txt.