Security

Report a security problem

If you think you have found a security weakness in Golden Ledger, email security@goldenledger.co.uk. Please tell us the page address, what you did and what you saw, so we can repeat it.

Our machine-readable contact details are at /.well-known/security.txt.

While we look into it, please:

• look only at your own account and data, and do not open, change or delete information that is not yours;
• do not try to slow down or stop the service;
• do not use social engineering or physical attacks;
• give us a reasonable time to fix the problem before telling anyone else about it.

Denial of service, and anything about a council's or owner's own systems, are out of scope. Please do not test other people's accounts without their written agreement.

What to expect

We acknowledge reports within three working days and tell you what we found or fixed. If we decide not to fix something, we tell you why. If a report affects personal information, we tell the councils concerned so they can meet their own duty to tell the ICO (UK GDPR Article 33).

Our promise to you

If you follow these rules and report in good faith, we will not start legal action against you, and we will not ask anyone else to. We cannot speak for others, such as your council or Microsoft, but we will tell them in good faith what you found.

A suspicious letter or email

Golden Ledger never asks for payment, bank details or your password, by letter, email or phone. If a message asks for any of them, it is not from us: do not reply, and report it to your council and to Action Fraud.

Is my letter genuine? shows how to check a council letter before you use its code.

What is in place today

Each of these was checked on 22 October 2026.

• Encrypted connections. Every page is served over HTTPS. A plain http:// address is sent to https://, and browsers are told to use HTTPS only for this site for two years.
• Sign-in. Sign-in is run by WorkOS, so Golden Ledger never stores your password.
• Access codes. A code typed in is checked against a scrambled (hashed) copy. The plain code is kept so the council that sent the letter can see it. Attempts to enter codes are counted and limited, both for each network address and for codes that start the same way.
• Who sees what. Each council sees only the buildings in its own area, and an owner sees only the buildings linked to their company. The server checks this on every request.
• Uploaded documents. Your browser sends each file straight to private storage in Microsoft Azure's UK South region, using permission to write that one file for 30 minutes. Microsoft Defender for Storage scans each file for viruses. Golden Ledger reads a document only after it has passed the scan, and nobody can download a file Defender finds infected. Downloads pass through our server, which checks who is asking first.
• No stored keys for Microsoft services. Golden Ledger reaches Azure through a Microsoft Entra identity, not a password or key kept in its settings.
• Where it runs. Application servers: Vercel (London). Database: Neon (London, AWS eu-west-2). Documents: Microsoft Azure Blob Storage, UK South.
• Staff access. MatchKey staff access is limited by role, and changes staff make are recorded.
• Browser protections. Other websites cannot show Golden Ledger pages inside their own, and browsers are told not to guess file types or pass full page addresses to other sites.

How we handle personal information, including where each supplier holds it, is in our privacy notice. Trust and data sets out the same facts for owners and councils.