Security

In one SQLite file in your own user profile, at %LocalAppData%\FreeLedger\freeledger.db. There is no server copy, no synchronisation and no backup we hold, which removes the entire class of breach where somebody else's database leaks yours.

The file inherits your operating system's file permissions. If the machine is shared, use separate Windows accounts, and consider turning on BitLocker or another full-disk encryption — that is what protects the file if the laptop is stolen.

The one secret the application stores, your SMTP password, is encrypted with your Windows account through DPAPI. Copied to another machine or opened as another user, it decrypts to nothing.

Releases are signed offline with an Ed25519 key that never reaches the update server, and the public half is compiled into the application. Every installation verifies the signature over the release manifest, and then the SHA-256 of the downloaded installer against the one the manifest names, before anything is run.

• A forged or tampered manifest is refused.
• An installer that does not match the hash in its manifest is refused.
• A manifest for a channel you did not ask for is refused.
• A version older than the one you run is refused.

Taking control of the update server is therefore not enough to push an update: the server holds no key to sign one with.

The download page publishes the SHA-256 of the current installer. You can check the file you received against it before running it:

• Windows (PowerShell): Get-FileHash .\FreeLedgerSetup.exe -Algorithm SHA256
• Linux or macOS: sha256sum FreeLedgerSetup.exe

If the value does not match the one on the download page, do not run the file — and please tell us, because it means something between us and you altered it.

The installer is not yet signed with a commercial code-signing certificate, so Windows SmartScreen may show “Windows protected your PC” on first run. That warning means the file is not widely seen yet — not that anything is wrong with it. The SHA-256 above is how you check it independently, and it will not be silently swapped for a different file.

• Installs for your user account only, into %LocalAppData%\Programs\FreeLedger — no administrator rights, no UAC prompt.
• Writes two values under HKCU so the updater can find the installation, and nothing else in the registry.
• Installs no services, drivers, scheduled tasks, browser extensions or startup entries.
• Bundles no third-party offers, toolbars, adware or telemetry.
• Leaves your books alone on uninstall unless you explicitly ask for them to be deleted.

Write to security@freeledgerapp.com with enough detail to reproduce the issue. We aim to acknowledge within 72 hours, and we will not take legal action against good-faith research that does not damage users' data or degrade the service for others.

Please give us a reasonable window to ship a fix before disclosing publicly. Fixed issues are described in the changelog that ships with the application.