Security
This page is deliberately specific. A ledger that touches a brokerage account should be able to say exactly where its limits are, and why they hold even if you do not take our word for it.
Where a broker separates reading from trading, Ledgepod asks for reading. Where it does not, the app still never calls a trading endpoint — and the guide tells you plainly which brokers make that distinction and which do not, so you can decide.
Secrets are stored with Windows' own data protection, tied to your user account on that machine. Copying the file to another computer gets an attacker nothing. Ledgepod never sees your broker password — you sign in at the broker.
The app serves its own window on your machine's loopback address only. There is no inbound port, no remote access, and no way for anyone — including us — to reach into a running installation.
Every release carries a publisher signature. The app verifies it on your machine and refuses anything that does not check out. An update that fails rolls itself back to the version that worked.
The files that decide what the app is allowed to do are encrypted and integrity-checked. If one is altered outside the app, the app pauses itself into a read-only state, tells you, and keeps your statements readable.
If you turn on reporting, what goes out is money and health figures under a username you choose. Account numbers, names, passwords and file paths are filtered out — and the app will show you the exact payload before it sends one.
The trust chain
Ledgepod checks its own entitlements the way a browser checks a certificate — through a chain that ends at a key we hold offline, not at a setting on your disk.
Its public half is baked into every release. It is what signs releases, and it is the only thing the app trusts by default.
One signature, made once. The app will not accept a statement from a hub whose key does not carry that certificate.
Your tier, and which pods you may run, come only from a statement that verifies through that chain. Editing a file on your own computer changes nothing.
The statement, its issue date and its validity window are on screen. If verification fails, the app says so rather than falling back to a guess.
Honest limits
It does not make a bad strategy profitable, and it does not stop a trading engine from losing money — a pod trades exactly as your engine trades. It cannot protect an account whose keys you have pasted somewhere else. It cannot recover a passport passphrase you have lost. And software this young has bugs in it; that is why every build is tested against a real ledger before anyone sees it, and why it is still in private testing.
If you find something wrong, we would rather hear it than not: hello@ledgepod.com.