Self-hosted first
Deploy the application, PostgreSQL, storage, and telemetry within your own operational boundary using Docker and Kamal.
Security and deployment
Keep billing evidence inside infrastructure you control.
Ledger is a private, self-hosted Rails application with organization-scoped records, invitation-controlled access, production security defaults, and no requirement to hand provider credentials to a hosted third party.
Organization scoped
Imports, source objects, normalized datasets, calculations, Cost Pools, memberships, and jobs carry organization ownership.
Minimal credential surface
Current imports are file based. Ledger does not require standing AWS, Azure, or Google Cloud credentials to calculate costs.
Application controls
Access is closed after the first owner is established.
Bootstrap can create one initial owner. After that, registration is invitation controlled, tokens are stored as digests, sessions expire, and password reset links are time limited.
- Authentication
- Password hashing, generic failure responses, reset token expiry, and endpoint rate limits.
- Sessions
- Server-side records, secure cookies, absolute and idle expiry, other-session revocation.
- Invitations
- Hashed one-time tokens, intended organization and role, expiration, and acceptance audit metadata.
- Authorization
- Current membership context, owner-only administration, and cross-organization rejection tests.
Production baseline
Fail closed on deployment-sensitive settings.
Production boot requires an allowed host, application URL, mail sender, database, and encrypted credentials. TLS, secure cookies, HSTS, CSP, and host authorization are enabled.
TransportTLS + HSTSTrusted proxy behavior is explicit.
BrowserCSP + secure cookiesProduction policy limits executable origins.
HostAllowlisted domainsHost header protection fails closed.
DatabasePostgreSQLExact monetary storage in production.
DeliveryAutomated Kamal deployOnly after required CI checks pass.
TelemetryRedacted OpenTelemetryPipeline context without source contents.
Billing data handling
Evidence is retained because explanations depend on it.
Immutable source objects
Accepted objects record size, type, digest, and ownership. Conversion verifies the stored bytes before reading.
Redacted diagnostics
Logs and traces carry identifiers, counts, timing, and failure categories, not raw billing rows or credentials.
Explicit retention decisions
Self-hosted operators control storage and backups. Deleting evidence is treated as a financial retention decision.
No AI calculation path
Financial processing remains deterministic. Future AI assistance cannot replace calculation or mutate immutable results.
Public TLSKamal proxyRails web + jobsPostgreSQL
Simple production architecture
One application, one authoritative database, observable jobs.
The first deployment keeps application and jobs together. Rails and workers can be split horizontally when workload demands it, without introducing Kubernetes-specific assumptions.
Read the production runbooksResponsible disclosure
Security reports have a private path.
The repository includes a security policy for reporting vulnerabilities without opening a public issue. Deployment operators remain responsible for host hardening, database access, backups, secret rotation, and retention policy.
Read SECURITY.md