Trust

Privacy and your data

Ledger measures what your assistant does. It does not need to know who your customers are, so it never keeps what identifies them.

What is masked

Before any conversation text is stored, Ledger replaces personal details with a tag:

Phone numbers, in any format and any script of digits: [phone]
Email addresses, also when spelled out (“sara dot h at gmail dot com”): [email]
Card numbers: [card]
IBANs: [iban]
Emirates ID and passport numbers: [id]
Links, payment links included: [link]
Names you pass to the SDK, and names a customer introduces (“I’m Sara”, “my son Omar”): [name]

“Can I book for Saturday? Call me on 050 123 4567” is stored as “Can I book for Saturday? Call me on [phone]”.

With the SDK: in your app, before anything is sent. Message text, outcome details and hand-off reasons are masked on your server. Ledger masks them again on arrival.
With Twilio or Vapi: on arrival, before anything is stored. The raw message or call report is never logged and never stored.
Your AI calls carry no text. When the SDK wraps your AI client, it sends counts and labels only: time, tokens, stop reason, tool names. Never the prompt, never the answer.
Customers are a fingerprint. The phone number or user id you pass is turned into a one-way code with a secret that belongs to your workspace. Ledger can tell that the same customer came back, but not who they are. The raw value is never stored.
Reading conversations. To find topics, mood and unanswered questions, Ledger reads the masked text only.

Every company has its own workspace. Every row of data carries its workspace, and the database itself refuses to return or write a row of another workspace.
A key or a connector link belongs to one workspace. It can only add data to that workspace, and an API key can only read that workspace’s status.
Automated tests check that one company can never read or write another company’s data.
Ledger runs on Google Cloud, in Europe (Belgium).

Conversation text: 90 days. 90 days after a conversation starts, its transcript is deleted.
Your numbers stay. Counts, wins and costs remain on your dashboard, so you can compare months.
Want everything deleted sooner, or your workspace closed? Write to us.

When you create an API key or a connector link, Ledger shows it once, in full. It then keeps only a fingerprint (a one-way hash) and the first characters, so you can tell your keys apart.
Nobody at 100x can read your key back. Lost it? Create a new one in Settings → Keys and revoke the old one. A revoked key stops working at once.
Keys and tokens are never written to logs. Connector links carry no secret in their path, because servers log paths.
Setup never asks for your Twilio or Vapi password or account token.
Keep your key on your server, in an environment variable. Never in a browser, never in your code repository.