Ledgerful reads your repo, analyzes it entirely on your machine, and writes real evidence to disk. The local engine, the loopback dashboard, and this public site are three distinct surfaces — a future hosted control plane is planned and always marked as such, never shown as already live.
Before the surfaces and the diagram below, here is the actual workflow — with real, redacted evidence beside each output, not a mockup.
Ledgerful reads your local git repository: the working tree, diffs against a base ref, commit history, and its own local config and state under .ledgerful/. It does not read files outside the repo, and source code, diffs, and commit messages are not uploaded anywhere by default.
scan, verify, and audit run entirely on your machine — deterministic checks against repo state, no network calls by default. The ask workflow is the one path that can leave the box, and only when you configure and select a cloud model; it is a separate, explicitly configured mode, not part of the default analysis.
A scan can produce a risk summary, a verification plan, and a signed provenance record written to the ledger; the dashboard can turn ledger history into a SOC 2-style evidence export. Below is real, redacted output from a dated v0.2.12 capture of each — the same artifacts shown on the homepage.
Tells you what to test before you merge.
Verification Steps:• git diff --cached --check (timeout: 400s)• git diff --check (timeout: 400s)• npm run build (timeout: 400s)Dry run mode: verification plan displayed above. No commands were executed.
A signed receipt you can verify offline.
tx_id: e09f48ab-0afe-4881-833f-8fd80048ea34category: BUGFIXentity: src/invoice.rschange_type: Modifysummary: fix(invoice): [DEMO] fix rounding error in tax calculationreason: Switch tax calculation from f64 to Decimal to eliminate floating-point rounding.committed_at: 2026-07-14T01:47:02.876335722+00:00signed: yessignature: f3e27176…39807
Hand to an auditor; no dashboard required.
{"generatedAt": "2026-07-14T01:47:02.982622805+00:00","files": [{ "name": "chain_head.json", "sha256": "3a0555a3cdc06156530aaff441232247bae2c105ea7c199b8c9a77f836cba68f", "size": 431 },{ "name": "ledger.csv", "sha256": "25ca4a8d…2927b63", "size": 3266 },{ "name": "verification_history.csv", "sha256": "56ef6d6a…6ed0e84", "size": 57 }],"entryCount": 7}
The host runs the engine and dashboard. The public web is static and does not host a control plane. The hosted mode is planned and is shown dashed.
127.0.0.1only and telemetry is opt-in. Outside the boundary, the public web is a static site with no hosted backend. The hosted control plane, shown with a dashed border and labeled “planned · not live,” does not exist yet.Each surface has an explicit state. The hosted control plane is planned and not shown here — see editions for what is coming.
The Ledgerful binary runs entirely on your machine. The default build owns the ledger, scan, audit, verify, web (daemon), and MCP command surfaces. Local sync is feature-gated and requires a --features sync build. No remote service is required for normal operation.
The dashboard is a local web UI served by the Ledgerful daemon, bound to 127.0.0.1:52001 with an ephemeral session token. It is not accessible from the internet or other machines on your network.
This site. Static, deployable on Vercel, no hosted backend. Public docs describe the local product; they do not run a hosted control plane.
Five modes describe what crosses the local-first boundary. Scan, ledger, audit, verify, dashboard, and export stay local. Feature-gated sync also stays local when compiled with --features sync; cloud model context and aggregate telemetry are separate configured paths.
| Mode | What crosses the boundary | Status |
|---|---|---|
| Local default | Ledgerful runs on your machine, reads from your repo and local files, writes to .ledgerful/. Source code never leaves the host. No remote calls for scan, ledger, audit, or export. | Available · Runs locally |
| Local team sync | With a sync-enabled build, signed and encrypted bundles are written to a directory you choose. You control the transport (a shared drive, a USB stick, or any other dir://-compatible path). Nothing broadcasts. | Beta · Runs locally |
| Telemetry (opt-in) | Disabled by default. When enabled, structured usage events are sent to a Supabase ingest endpoint. Source code, file content, diffs, and commit messages are never transmitted. | Available · Runs locally |
| Configured cloud model | The ask workflow can send sanitized, truncated impact and retrieved codebase context to Gemini, Ollama Cloud, or OpenRouter when that provider is configured and selected. Separately, ledgerful index --fast can send code chunks to a configured Gemini model for semantic extraction. Local-model operation does not use these paths. | Available · Runs locally |
| Hosted control plane | A future hosted mode will add tenancy, hosted audit log, GitHub App callbacks, billing, and SSO/SCIM/RBAC. None of this is shipped today — see /editions for explicit state labels. | Planned · Hosted |
Telemetry, when enabled, sends the aggregate schema documented on the security architecture page. Separately, configured cloud-model ask workflows can send sanitized, truncated context to the selected provider. See the security architecture page for the full telemetry schema.
Optional local context bridge (off by default, advanced/unstable). Ledgerful can expose an INTERNAL/UNSTABLE local interface — inactive unless you explicitly enable it — that passes analysis context (file paths, symbols, verify outcomes, and exported ledger and impact records) to a separate local process you run. Transport is local IPC only (a named pipe or local subprocess); Ledgerful opens no network connection for it, and it is not a supported public API. It is listed for completeness of the data-flow boundary, not as a product surface we promote.
The local daemon binds exclusively to http://127.0.0.1:52001. CORS is restricted to localhost and 127.0.0.1 on any port — cross-origin requests from remote or hosted domains are rejected. The launch URL carries an ephemeral ?token=<hex> once. The dashboard captures it in memory, strips it from the browser URL, and sends subsequent API requests with Authorization: Bearer <hex>. Tokens are per-session and are never persisted to disk.
An Ed25519 key pair is generated on first use via OS entropy. The signing key and verifying key are stored as hex-encoded files at ~/.ledgerful/keys/private.key and ~/.ledgerful/keys/public.pem (Windows: %USERPROFILE%\.ledgerful\keys\). The SOC 2-style evidence ZIP is generated entirely from local data; the manifest, signature, hashes, ledger CSV, verification history, and ADR files never leave the host during export.
Hardware-backed key storage, hosted KMS, SSO/SCIM, and RBAC are planned for enterprise. They require the future hosted control plane and are not implemented in the local daemon.
Pair the architecture page with the install path, the trust posture, and the release evidence.