How it works
Certified selective acceptance, explained.
Ledger is not built to be the most accurate extractor. It is built to answer the question a buyer actually has: which extractions can I post without a human looking, and what is the real error rate among those? Here is how it earns that answer.
In plain terms
- 01
You send your documents
Invoices, receipts or forms, plus the fields you need — no new software for your team to run.
- 02
Certified fields post automatically
The values Ledger can stand behind at your chosen risk level go straight into your data — no one has to check them.
- 03
The uncertain few go to review
Anything below the bar lands in a short review list your team clears — instead of silently entering wrong data.
Under the hood
text layer · token boxes · OCR
no paid OCR in the path
two structurally different readings — failure modes point opposite ways
field-guided
tends to invent on absence
document-guided
tends to miss the non-salient
on the page?
page + bbox, zero model calls
the two reads
disagreement → review
type · format · sums
capped, deterministic
certify or route
auto-accepted
routed to a human
The path a value takes
Six stages, each deterministic where it can be.
- 01
Ingest
Read the document’s text layer and token boxes, or OCR it. No paid OCR service in the path.
- 02
Two readings that fail differently
One reading (Hunter) looks only for the fields you asked for; the other (Mapper) reads the whole document. The first can guess when a value is missing; the second can overlook values that aren’t prominent. Because they fail in opposite ways, their disagreements catch each other’s mistakes — unlike running one model twice, which repeats its own blind spots.
- 03
Anchor
Deterministically check that each value is actually on the page, with page number and bounding box. Values that appear nowhere are flagged as invention — zero model calls.
- 04
Reconcile
Compare the two reads. Disagreement between them is a signal, and it routes to review rather than into your data.
- 05
Validate
Type, format, and cross-field checks (sums, totals) — capped and deterministic.
- 06
Certify or route
A distribution-free conformal bound decides what can be auto-accepted at your chosen risk α. Everything else is routed to a human-review queue. Where the bound cannot hold, nothing is auto-accepted.
What you actually get back
A verdict per field, with its provenance.
Certified fields are auto-accepted under the bound. Anything below the certified threshold — or where the two readings disagree — routes to review instead of entering your data.
- certified
- Inside the proven bound at your chosen risk α. Post it without a human.
- review
- Honest uncertainty — routed to a person, not silently accepted.
exact
exact
exact
exact
below certified threshold 0.951 → routed to review
an illustrative extraction — field values and scores are examples, not measured results
The guarantee
A distribution-free bound, not a confidence score.
The certificate is produced by a conformal procedure on a held-out calibration slice of your own documents. It makes no assumption about the shape of the data. The claim it licenses is exact and checkable:
Of the fields Ledger auto-accepts, at most α are wrong — with the observed selective risk reported at or below α on held-out data.
When the data will not support the bound at your risk level, Ledger does not lower the bar to look good. It marks the field UNCALIBRATED and auto-accepts nothing.
Designed against silent failure
There are three documented ways a selective-risk guarantee silently breaks. Ledger was built against all three from the first commit:
- 01 Within-document clustering
- 02 Score-refit leakage
- 03 Score-distribution collapse
built against the 2026 selective-risk-control literature
Why it holds
The parts that make the guarantee real.
Certified selective acceptance
Of the fields Ledger auto-accepts, at most α are wrong — where α is a risk level you set in advance (say 5%). That ceiling is established by a distribution-free conformal procedure on held-out data, not asserted. Where it cannot hold the ceiling, Ledger marks the field UNCALIBRATED and auto-accepts nothing.
Provenance that cannot be hallucinated
Every value is located in the page’s own text, by us, with page and bounding box. A value that appears nowhere on the page is flagged as invention with zero model calls.
Two structurally different readings
Every document is read two ways whose failure modes point in opposite directions — not one model sampled twice, which shares its own blind spots.
Any document type by configuration
A new job is a schema plus a few labelled samples, not new code.
No paid OCR or vision API
Cost per 1,000 documents is measured and published, not projected. Runs on a Claude subscription; an SDK backend is available for production.