Compliance / Data handling
Data handling
What Ledgerline stores, how it is protected, how long it is kept and which responsibilities stay with you. Share this page with your compliance team before you go live.
Who is responsible for what
| Area | Ledgerline | You |
|---|---|---|
| Card data | Collects and stores card numbers on hosted checkout. Card numbers never reach your servers. | Use hosted checkout or the Ledgerline SDK. Never collect card numbers in your own forms. |
| API keys | Encrypts keys at rest and lets you roll them at any time. | Keep secret keys on your server and limit who can see them. |
| Customer data | Processes it to complete payments, as your data processor. | Tell customers you use Ledgerline, in your own privacy notice. |
| Webhooks | Signs every event. | Verify signatures and serve your endpoint over HTTPS. |
What we store
| Data | Why | Kept for |
|---|---|---|
| Payment records: amount, status, reference, timestamps | Settlement, reporting and disputes | 7 years after the payment |
| Customer email and name | Receipts and dispute handling | 7 years after the last payment |
| Card details (tokenised) | Completing and refunding card payments | Until the card expires or you delete the customer |
| API request logs | Support and security investigations | 90 days |
Your own record-keeping obligations may differ from ours. Check with your compliance team which retention periods apply to your records.
How data is protected
- All traffic uses TLS 1.2 or later. Plain HTTP requests are refused.
- Data at rest is encrypted with AES-256. Card data sits in a separate, isolated environment.
- Staff access to production data needs two-factor authentication and is logged.
- Data is stored in data centres in Lagos, with backups in a second Nigerian region.
Customer data requests
If a customer asks you to delete or export their data, send the request through Dashboard → Customers → Data requests. We complete it within 30 days, except for records we must keep by law, which we explain in our response.
Need evidence for an audit or a security review?
Account owners can download our current security overview and data processing agreement from Dashboard → Settings → Compliance.
Last updated 28 October 2026