Security & Trust

Lejar holds your business's financial records, so we would rather describe exactly what protects them than speak in generalities. This is what is running in production right now, not something planned:

• Encrypted in transit and at rest. Every connection to Lejar uses TLS. Supabase, our database provider, encrypts all data at rest with AES-256.
• An append-only ledger. Once a journal entry posts, it cannot be edited or deleted. Corrections happen through new entries, and every posting is captured in an audit log that even our own service accounts cannot alter or erase.
• Access control enforced by the database, not just the app. Row-level security in Postgres keeps every organisation's records isolated: a member of one organisation cannot read another organisation's data, even if the application code above it had a bug.
• The AI only drafts. It never posts on its own. Every AI-generated entry, whether from a scanned receipt, a bank statement, or a request in Ask lejar, waits in a review queue. Nothing reaches your ledger until you approve it.
• Field-level encryption of your most sensitive details. Bank account numbers and DuitNow IDs carry an additional layer of application-level encryption, on top of the at-rest encryption above, scoped to each organisation.
• A record of security events. Sign-ins and account changes are written to an append-only security-events log that your organisation's owners and admins can review.
• Optional two-factor sign-in. Any member can turn on TOTP two-factor authentication for their account.

Your organisation's database, file storage, and authentication run on Supabase infrastructure in the ap-southeast-1 (Singapore) AWS region. Under Malaysia's PDPA, storing and processing data outside Malaysia is permitted with your consent, which you give by using the service. See the Privacy Policy for the full list of where each subprocessor below runs.

We use a small, disclosed set of infrastructure providers to run Lejar. This is the same list named in the Privacy Policy, gathered here with each vendor's compliance posture.

Airwallex does not publish one canonical Data Processing Agreement URL, so the link above is their security and compliance hub instead. We are requesting a signed DPA copy directly from their account team.

• Access and export. Export your organisation's accounting data yourself at any time from Settings. No request or wait required.
• Correction. Email us to correct inaccurate personal data we hold about you.
• Erasure. Delete your organisation directly from Settings. This removes its records from our live systems immediately; copies in infrastructure backups fade out on their own rolling schedule.
• AI-memory transparency. See exactly what Lejar's AI has learned about your organisation, and delete any of it, in Settings. It is private to your organisation and included in your data export.
• Breach notification. If we become aware of a personal data breach affecting you, we are committed to notifying Malaysia's Personal Data Protection Commissioner within 72 hours of becoming aware, consistent with the Data Breach Notification Guideline, and to notifying you directly where the breach is likely to cause you significant harm.

Full detail on what we collect and why is in the Privacy Policy.

Found a security issue? Email security@lejar.ai. Security researchers and automated scanners can also read our machine-readable disclosure policy at /.well-known/security.txt (RFC 9116).

We would rather tell you what is still in progress than let this page imply we have covered everything. This is what is not true yet:

• We have not undergone an independent security certification (SOC 2, ISO 27001) or a third-party penetration test. Our subprocessors above are certified; we have not certified our own controls.
• Two-factor authentication (TOTP) is available today, but it is optional: we do not yet require it to sign in.
• A strict, nonce-based Content-Security-Policy actively blocks unauthorised scripts across the signed-in app (login, your dashboard, and every organisation's workspace). Two areas stay in report-only mode a little longer: the billing and checkout pages, while we validate our payment provider's script and connection origins against a real transaction, and our public marketing pages, while we gather more real-world signal before enforcing there too.