The short version. Your uploaded CSV file is never written to disk — it is parsed in memory and discarded when the request ends. If you are signed out, nothing at all is saved. If you are signed in and save a run, we store the resulting numbers, not your file. We have never sold or shared customer data, and no advertising or analytics service receives any dollar figure from your account.
1. Your CSV file is not stored
When you upload an Airbnb transaction-history export, the server reads it into memory in 64 KB chunks (capped at 10 MB), parses it, and drops the bytes. There is no temporary file, no upload directory, and no object storage bucket. Once the HTTP response is sent, the original file no longer exists anywhere on our infrastructure.
This is a property of how the ingest path is written, not a policy we promise to follow. There is no code path that writes an uploaded file to disk.
2. What we store, and only when you ask us to
Using Roost Ledger signed out — including the free reconcile and the demo — stores nothing about you. There is no account, so there is no record.
When you create an account and save a reconciliation run, the database holds:
| What | Detail |
|---|---|
| Your email address | Used to identify your account and send login links. No password exists — we never create or store one. |
| Reconciled totals | Aggregate figures from a saved run: gross rental income, service fees, cleaning fees, occupancy taxes, refunds, plus per-listing and per-year breakdowns. |
| Expenses you enter | Date, Schedule E category, amount, and any note you type. |
| Estimated-tax settings | Your assumed tax rate, reminder preferences, and any 1040-ES payments you log. |
| Billing status | Your Stripe customer and subscription identifiers, and whether the subscription is active. |
We do not ask for and do not store your Social Security number, taxpayer ID, bank account numbers, property addresses, or guest names. We never receive your Airbnb password — there is no Airbnb account connection; you export the CSV yourself.
3. Where it lives
Roost Ledger runs on a single virtual machine in Google Cloud (us-east4). Application data is held in a SQLite database on a Google Compute Engine persistent disk. Google encrypts those disks at rest with AES-256 by default, so the underlying storage is encrypted; we do not additionally encrypt individual database columns at the application layer. The database is not reachable from the public internet — only the web tier is exposed.
4. In transit
The whole site is HTTPS-only, with certificates issued automatically by Let's Encrypt. We send an
HSTS header (max-age one year, including subdomains), which instructs your browser to
refuse to talk to us over plain HTTP at all. The application server itself is not published to the
public internet; it is only reachable through the TLS-terminating proxy.
5. Signing in
Authentication is passwordless. You enter an email address and we mail a single-use link that expires in 15 minutes. We store only a SHA-256 hash of that link's token, never the token itself, and the same is true of your session cookie — the database holds a hash, so a copy of the database does not hand an attacker a working session.
The session cookie is HttpOnly, Secure, and SameSite=lax, and
lasts 30 days from last use. Login-link requests are rate-limited to five per hour per email address
and five per hour per IP address.
6. Separation between accounts
Every query that touches financial data is scoped to the signed-in user's ID; a request for another account's run, expense, or P&L returns "not found" rather than data. This is covered by a dedicated suite of automated tenant-isolation tests that run against a real database on every change — they assert that a second account cannot read, modify, or delete the first account's records, and that internal user identifiers never appear in API responses.
7. Who else sees anything
Three third parties are involved, each with a narrow slice:
| Service | What it receives |
|---|---|
| Stripe payments |
Your email address and your card details, which go directly to Stripe — card numbers never touch our server. Stripe receives none of your rental income, expense, or reconciliation figures. |
| Our email provider Resend |
Your email address and the contents of the mail we send you. Note that if you opt into quarterly estimated-tax reminders, the reminder email contains your suggested payment amount — so that one dollar figure passes through the email provider. No other financial data is sent. |
| Google Ads / Google Tag marketing measurement |
Page views and conversion events on the marketing site. It receives no dollar amounts, no CSV contents, and no account data. |
We do not sell your data, we do not share it with data brokers, and we do not use your financial figures to train any machine-learning model. There is no AI service in the processing path — the reconciliation is deterministic arithmetic.
8. How long we keep it
Saved runs and expenses persist until you delete them. You can delete individual reconciliation runs and expense records yourself from within the app at any time.
Being straight with you: there is currently no self-service "delete my entire account" button. If you want your account and everything in it erased, email support@roostledger.com and it will be done manually. We would rather tell you that than imply a control that does not exist. A self-service deletion endpoint is on the list.
9. What we do not have
Roost Ledger is a small, independent product, and pretending otherwise would be the least trustworthy thing on this page. Here is what we cannot claim:
- No SOC 2, ISO 27001, or third-party penetration test. None has been performed. Any product our size claiming one deserves a hard look.
- No application-layer field encryption. Amounts are stored as ordinary numbers. The disk beneath them is encrypted by the cloud provider; the columns are not separately encrypted.
- Single-server architecture. One VM. No hot standby, no multi-region replication. If it goes down, the app is down.
- No self-service account deletion yet, as described above.
- Not a financial institution. We do not hold funds, we never connect to your bank, and we cannot move money.
The mitigating design choice is scope: because we never store your source file, never connect to your bank, and never ask for your SSN or account numbers, the worst case for a Roost Ledger breach is the disclosure of rental income totals and expense records — not credentials, not identity documents, not funds.
10. Reporting a vulnerability
If you find a security issue, email support@roostledger.com with the details. We will acknowledge it. We will not pursue legal action against anyone who reports a flaw in good faith and does not access, alter, or exfiltrate other people's data while finding it. This good-faith safe harbour is incorporated into our Terms of Service (Section 6), which carves out security research conducted within the scope of this policy from the general prohibition on probing the Service's systems. The safe harbour does not cover actual attacks: denial-of-service, accessing or exfiltrating another user's data, or altering records you do not own remain prohibited.
Questions
Anything unclear or anything you think this page gets wrong — support@roostledger.com. See also our Privacy Policy and Terms of Service, which are the binding legal documents; this page is the plain-language explanation of how the software behaves.