Skip to content
LekhaBook a walkthrough (opens in a new tab)

Your books stay yours, private and complete

Lekha keeps the legal books of your company. Here is exactly how we keep them private, complete and in your hands, in plain words first and technical answers below.

Where your data lives

Lekha runs on servers in Singapore, close to Dhaka for speed. Backups are kept in the EU, in a different country from the servers.

You can download a full copy of your books at any time. If Bangladeshi law requires a copy of your books in Bangladesh, we provide one.

No other company sees your books

Every row of your books carries your company. The database itself refuses to show it to anyone signed in to another company, and Lekha runs as a database user that can't switch that rule off. An automated test opens every page while signed in to another company and checks that none of your data appears.

You decide who gets in

People join your company only when your owner invites them, as Accountant or Viewer. Viewers never see salaries. Two-factor sign-in and a log of every sign-in protect each account.

Nothing disappears

A posted entry is never edited or deleted: a mistake is reversed by another entry, so the trail stays complete. Changes to settings and opening balances are recorded with who changed what, and when, in a history the database won't let anyone edit. Your accountant can print the full audit report.

Our support can look, not touch

When you ask for help, our support sees your books read-only. Every visit is logged and shown to you. Any fix goes through an audited script, never by hand.

What we never store

The less we hold, the less can leak. Lekha keeps what your books and returns need, and nothing more.

Technical questions

How is my company's data kept apart from others?
With row-level security in PostgreSQL on every company table. The application connects as a role that can't bypass it, and Lekha refuses to start if it ever connects as one that can.
Is the connection encrypted?
Yes. Lekha is served only over HTTPS, browsers are told never to use plain HTTP (HSTS), and sign-in cookies are sent only over secure connections.
What happens to our books if we stop paying?
After 14 days' grace they become read-only. Nothing is deleted: you can open every report and export everything.
How long are our books kept?
We keep them for twelve years after the end of each fiscal year, even if you leave Lekha.
Can a VAT officer see our books?
Only if you give them access. Your owner can export the books for an officer or add a read-only login for the visit.
Is Lekha certified (ISO 27001, SOC 2)?
No. This page sets out what we do instead.

Report a security problem

Found something? Email info@codefusionai.com. We reply within one working day and keep you posted until it's fixed.

Ask us anything about your data

In a walkthrough we answer your security and data questions, with your IT person if you like.