We Don't Just Protect Data. We Respect It.

Connections use TLS. Uploaded files are encrypted at rest by the storage provider. Phone numbers and client contact email are encrypted at the application layer.

The application and its database run on a dedicated server in Mumbai, and uploaded files are stored in Google Cloud Storage's Mumbai region. Pages are served via Vercel. Every subprocessor is listed in the Privacy Policy.

The Google Chrome extension sends approved requests to Tally on the same Windows computer. Selected results may be stored when required by an application workflow.

We do not sell customer financial data. Necessary service providers are disclosed in the Privacy Policy.

Sign in with Google OAuth or email with signed JWT tokens. A sign-in lasts two hours, and an idle session signs itself out after twenty minutes.

Add a second step at sign-in: a one-time code sent to your registered email address, with a backup code as fallback if you can't access that email.

Sign-in, sign-up and password reset run a Cloudflare Turnstile check first, and every request is rate limited — counted per signed-in user, so one busy colleague cannot lock out the rest of your office.

Every account must pass email verification before gaining access. Google sign-in users are verified automatically.

Give each colleague only the rights they need — upload, categorise, push to TallyPrime, delete — and limit them to the clients you assign. The server checks this on every request.

Uploads, ledger changes, deletions, exports and Tally pushes are recorded against the person who made them. Read the trail in Settings, filter it by client or date, and export it.

Every database is dumped nightly, encrypted, and copied off the server to storage it cannot delete from. Thirty days are kept, and one backup is restore-tested every week.

Request account deletion from Settings. Eligible personal data is erased or de-identified through the process in our Privacy Policy, while records the law requires are retained.