Cryptographic integrity
Each artifact is content-addressed with SHA-256. Packet roots and exports are signed with a production Ed25519 key, and the public verification surface checks both the artifact commitments and signature.
Security & trust
Evidence is only useful if its integrity can be proven.
LedgerLens is designed as non-custodial evidence infrastructure. We do not move funds or store raw card credentials. We preserve the authority and transaction record around systems that do.
Access and tenant isolation
Cloudflare Access authenticates console users. LedgerLens then enforces exact workspace membership and role-based permissions in D1. API credentials are scoped, hashed at rest, revocable, and returned only once.
Storage and delivery
Structured records live in Cloudflare D1 and immutable evidence packets in R2. Signed webhooks use a queue with bounded retries and a dead-letter path. Production logs are structured and sampled to control cost.
Retention and deletion
Each workspace has a configurable retention period from 30 to 3,650 days. Retention removes expired packet objects and related records. Public verification links expire after seven days; product analytics are retained for 90 days.
Data minimization
Public verification is proof-only: transaction summary, hashes, signature, public key, and timestamps. Mandate payloads, prompts, internal notes, and payment instruments are not disclosed.
Current scope
LedgerLens provides technical evidence and deterministic failure attribution. It does not custody funds, submit card-network chargebacks, determine legal liability, or replace a payment provider's compliance program.