Security & governance
Govern the action
before you audit the outcome.
SynqLedger applies authority, approval and evidence throughout the business process — helping organisations control who can act, what can change and how the history is preserved.
Authority model
Control who can see, approve and change what matters
Seeing something, preparing it, approving it and executing it are four different responsibilities. Where the process requires it, they can stay in four different pairs of hands.
- 01
See
Look at the information the role is entitled to see.
- 02
Prepare
Assemble the action, with the evidence behind it.
- 03
Approve
Accept the action as an act of authority in its own right.
- 04
Execute
Carry out the consequence — once, and on the record.
Illustrative composition — not customer data.
Maker-checker
The person who prepares should not automatically be the person who approves
Separation of duties is only real when the system enforces it. In SynqLedger the preparer and the approver are distinct acts of authority — for payments, period close, payroll, migration cutover, group adjustments and other governed actions.
- Approval is a recorded act, not an informal sign-off
- The same person cannot stand on both sides of a governed action
- Separation applies across finance, operations, people and group reporting
Prepared by
Assembles the action and its supporting evidence.
Approved by
A different person accepts the consequence.
Same person, both roles
Declined. Where the process requires separation, the platform does not accept one person as both preparer and approver.
Boundaries
Access to one company should not become access to another.
Entity context stays explicit across operations, finance and reporting. Group reporting reads across companies through a governed consolidation view — never by quietly relaxing the boundary underneath.
Entity boundaries
One company at a time, unless you are entitled to more
A user works inside the companies they have been given. Anything outside that context is simply not part of their world — in enquiry, in operations and in reporting alike.
- Entity context travels with the work, not with the screen
- Group access is granted deliberately and separately
- Reporting across companies remains a governed capability
- In scope
UK trading company
Within this user's entity context
- Not in scope
Distribution company
Outside this user's entity context
- Not in scope
European subsidiary
Outside this user's entity context
- Not in scope
Group holding company
Group access granted separately
Illustrative composition — not customer data.
Sensitive information
Not every user should see everything the platform knows
People and payroll is the clearest example. Each role sees what its authority justifies — and employment cost still reaches the ledger without exposing individual pay to those who should not see it.
- EmployeeTheir own record, their own pay documents
- ManagerTheir team's working context, not individual pay detail
- PayrollPay calculation and statutory detail for their population
- FinanceEmployment cost in the ledger, not personal pay records
- ExecutiveWorkforce cost and trend at the level they are entitled to
Conceptual illustration — no personal data is shown.
Financial record integrity
Correct the record without erasing what happened
Posted financial history is preserved. When something needs to change, the correction is governed, dated and evidenced — sitting alongside the original rather than quietly replacing it.
- The earlier position remains part of the record
- Corrections carry their own authority and evidence
- Today's reported figure can always be explained backwards
Original
What was recorded at the time, and remains recorded.
Governed correction
A dated, authorised change with its own evidence.
Current position
What the business reports today — and why.
Nothing is quietly removed. The earlier record stays part of the story.
Period control
When a period is closed, history should stay closed
Completed financial reporting is protected from ordinary backdated change. Later adjustments are governed, dated and visible — so a published month does not silently become a different month.
- Closed periods refuse ordinary new consequence
- Adjustments after close remain explicit and dated
- Reported comparatives stay stable over time
- Period 01Closed
- Period 02Closed
- Period 03Closed
- Period 04Open
A closed period does not quietly accept new consequence.
Auditability
Who did what, when, under whose authority — with the evidence attached
Audit should not be an archaeology exercise. Governed actions carry their own record of actor, approval, timing, object, outcome and supporting evidence.
- Actor
- Named user, acting under a granted authority
- Action
- The governed action they carried out
- Approval
- The separate person who accepted it
- Date and time
- When it happened, in sequence
- Business object
- The transaction or record affected
- Outcome
- What the platform did — or declined to do
- Evidence
- The supporting document or source behind it
Illustrative composition — not customer data.
Evidence is captured as the work happens.
Because authority and approval are part of the business process rather than an after-the-fact review, the answer to “who allowed this?” already exists by the time anyone asks.
Payment governance
Money should not move because someone found a button.
Payment authority and approval stay inside the governed process — preparation, review and execution as separate acts, each on the record.
Governance in place
Governed everywhere the platform has consequence
Governance is not a module. It is the same authority, approval and evidence model applied wherever an action changes money, stock, pay or the reported position.
Intelligence boundary
Intelligence proposes. Governed authority executes.
SynqLedger Intelligence is designed to explain the business behind the numbers — inside the same role, entity, approval and accounting boundaries as everyone else. It is not a route around governance.
- Explains and suggests; it does not approve
- Sees only what the person asking is entitled to see
- Executes nothing outside the governed authorities
Intelligence proposes. Governed authority executes.
Role
Proposals respect what the person is entitled to do
Entity
Company boundaries stay explicit
Approval
Approval remains a human act of authority
Accounting
Nothing posts outside the accounting authority
AI that understands the business behind the numbers is designed to work inside the same authority boundaries as everyone else — explaining and suggesting, never acting outside them.
Intelligence is in development and not yet available.
Assurance
Authority and evidence are part of the process, not an audit afterthought.
Product controls are described here as they behave. SynqLedger does not claim third-party security certification — what it claims is what the platform enforces and refuses.
Outcomes
What governance is worth in practice
Separate preparation from approval.
Governed actions require two hands, so a single person cannot originate and authorise the same consequence.
Keep company and data boundaries explicit.
Entity context and sensitive information stay scoped to the authority that justifies access to them.
Preserve the financial history.
Corrections are governed and evidenced; closed periods stay closed; nothing is quietly rewritten.
Know who acted and under what authority.
Actor, approval, timing, object, outcome and evidence are captured as the work happens.
Bring your controls matrix. We will show you what the platform refuses.
A guided walkthrough of authority, approval and evidence across payments, close, payroll, migration and group reporting.