Trust · Security
The approval gate is the security model.
DueLadder is built so that the dangerous action — emailing your customer about money — cannot happen on its own. This page states, plainly, the controls the product actually implements today.
What is enforced in code
- Per-message human approval. The send path refuses any draft without a recorded approval (HTTP 409) and leaves the draft pending. There is no auto-send mode and no bulk approve.
- Append-only audit log. Every draft created, approval, rejection, queued send and payment stop is written to an audit log. Signed-in users can read theirs in the app and export it as CSV.
- Payment stop. When an invoice is shown as paid, its pending and approved drafts are cancelled and a payment-stop entry is written. The ladder never drafts for a paid invoice again.
- Sessions. One HttpOnly, Secure, SameSite=Lax session cookie, signed server-side. Logging out — or changing your password — invalidates other sessions. Login is rate-limited.
- Password storage. Passwords are stored only as salted hashes. Password-reset links are single-use, expire after one hour, and only the token hash is stored.
- Accounting tokens. QuickBooks / Xero connections use OAuth 2.0 with single-use state values (callback CSRF protection). Access runs only against the fixed Intuit and Xero endpoints — the app never fetches a URL you supply.
- Transport and headers. HTTPS with HSTS, a restrictive Content-Security-Policy, X-Frame-Options DENY, and nosniff on every response.
- Honest unconfigured states. Without SMTP settings, approved mail waits visibly as “awaiting mail configuration” and is never marked sent. Without accounting credentials, the connections page says “not configured”. Nothing is simulated.
What we do not claim
DueLadder does not hold SOC 2, ISO 27001 or similar certifications, and this page will not pretend otherwise. If a certification is ever completed, the fact, the audit period and the auditor category will be published here in plain text.
Your invoice and customer data is used only to run your chasing ladder and summaries. We do not sell it. See the privacy page for the data-controller details.
Report a security issue
Email [email protected] or message us on WhatsApp. We read every report personally.
Last updated: 22 October 2026.