Split LedgerSign in

Legal

API & Data Security Policy

Effective Date: September 15, 2026

Operational Framework: Split Ledger Infrastructure (Dumb Luck Media LLC)

Split Ledger is architected from the ground up on zero-retention principles to ensure that your sensitive business banking records, vendor relationships, and receipt images remain private, encrypted, and isolated.

1. Authentication & Scoped API Access

  • Intuit QuickBooks OAuth 2.0: All QuickBooks Online ledger data exchanges run strictly over OAuth 2.0 authorization using Intuit's standard OAuth 2.0 sign-in. Split Ledger never collects or retains your primary Intuit username or password. API permissions are limited to accounting ledger creation and receipt image attachments.
  • Google Drive Scoped Security: Split Ledger interacts with Google Workspace via strictly bounded authorization scopes (https://www.googleapis.com/auth/drive.file). This scope ensures the application cannot view, read, index, or modify any files on your drive other than the specific folders and receipt images created directly through Split Ledger.
  • Secure Token Vaulting: External OAuth tokens, client secrets, and customer entity mappings are encrypted at rest using industry-standard AES-256 envelope encryption with rotating key management.

2. Optical Pipeline: Pure AI Vision (Zero OCR)

  • No Local OCR Codecs: Split Ledger operates without legacy Optical Character Recognition (OCR) libraries (e.g., Tesseract or legacy template-matching tools). Receipt text, numerical values, and metadata are interpreted through pure multimodal AI vision models capable of reading crumpled receipts, skewed angles, and varying font standards.
  • Managed Gateway Security: All vision processing queries are routed through our hardened enterprise server gateway using encrypted, dedicated API channels. You never provide an API key — receipt reading is fully managed by Split Ledger, and no sensitive AI credentials ever touch your device or browser.
  • Strict JSON Output Enforcement: Outbound AI extraction models are instructed under strict declarative JSON schema parameters (responseMimeType: "application/json"). Extracted data payloads are rigorously validated against strict typing boundaries before populating client forms.

3. Data Transit & Storage Routing Architecture

  • Private Vault Storage: When you take a photo or upload an invoice:
  1. The binary data streams over TLS 1.3 to our secure processing gateway.
  2. The AI vision model extracts structured transaction fields (vendor, date, items, amounts, tax).
  3. The image is stored in your private, access-controlled receipt vault and delivered to your designated storage endpoint (QuickBooks attachment and/or Google Drive folder).
  4. The image is never publicly hosted, indexed, or shared — it remains accessible only to your account until you delete it or close your account.
  • Transport Layer Security: All communications between client devices, our processing nodes, and connected third-party APIs are enforced via HTTPS using TLS 1.3 modern ciphers and HTTP Strict Transport Security (HSTS).

4. Multi-Entity Data Isolation

  • Tenant Boundary Protection: Each company profile, ledger route, and QuickBooks entity mapping within Split Ledger is isolated. Multi-LLC splits are computed mathematically in memory and sent as distinct, separate transaction payloads to each respective entity's books.
  • No Ledger Co-Mingling: Receipt files and split entries bound for Summit Ridge Builders are barred from interacting with Apex Property Holdings' programmatic payload.

5. Security Operations & Inquiries

  • Continuous Auditing: Split Ledger maintains automated dependency monitoring, regular code reviews, and API regression testing to identify and patch emerging security risks.
  • Responsible Disclosure: If you identify a potential security anomaly or vulnerability, submit your technical report directly to our engineering desk at security@getsplitledger.com. Reports are acknowledged within 24 business hours.
Disclaimers: QuickBooks Online and Intuit are registered trademarks of Intuit Inc. Google and Google Drive are registered trademarks of Google LLC. Split Ledger is an independent software application and is not endorsed or certified by Intuit Inc. or Google LLC.