How we handle and protect your data
Your clients' financial records are sensitive. This page explains where data is stored, who can reach it and what the Tally Connector can and cannot do.
How your data is protected
Encryption in transit and at rest
Connections use TLS. Uploaded files are encrypted at rest by the storage provider. Phone numbers and client contact email are encrypted at the application layer.
Primary hosting in India
The application and its database run on a dedicated server in Mumbai, and uploaded files are stored in Google Cloud Storage's Mumbai region. Pages are served via Vercel, whose edge also proxies application API traffic between your browser and the Mumbai server and may run at edge locations outside India. Every subprocessor is listed in the Privacy Policy.
Encrypted off-site backups
Every database is dumped nightly, encrypted, and copied off the server to storage it cannot delete from. Thirty days are kept, and one backup is restore-tested every week.
Who can get in
Sign-in and sessions
Sign in with Google or with your email and password. A sign-in lasts two hours, and an idle session signs out after 60 minutes.
Two-factor authentication
Add a second step at sign-in: a one-time code sent to your registered email address, or from an authenticator app such as Google Authenticator if you add one. 10 single-use backup codes work as a fallback.
Bot and brute-force protection
Every request is rate limited, counted per signed-in user, so one busy colleague cannot lock out the rest of your office. Repeated failed sign-ins temporarily lock the account.
Verified email addresses
Every account must verify its email address before it can be used. Google sign-in accounts are already verified through Google.
What touches your Tally
Chrome Tally Connector
The Tally Connector Chrome extension talks to Tally on the same Windows computer. It carries out only the pull or push you select.
Role-based team permissions
Give each colleague only the rights they need (upload, categorise, push to TallyPrime, delete) and only the clients you assign. The server checks this on every request.
Activity audit trail
Uploads, ledger changes, deletions, exports and Tally pushes are recorded against the person who made them. Read the trail in Settings, filter it by client or date, and export it.
What you control
Service providers we use
We do not sell customer financial data. The providers we use to run the service are listed in our Privacy Policy.
Closing your account
Close your account or request erasure of your personal data from Settings. Eligible personal data is erased or de-identified as described in our Privacy Policy; records the law requires us to keep are retained.
What we cannot do
Limits that are built in, not promised. Each one is a capability the software does not have.
We cannot delete anything in your Tally
Every voucher is sent as a create instruction carrying a fixed reference for its entry, so sending the same voucher again updates it in Tally rather than adding a duplicate. There is no delete instruction anywhere in the connector or the server, so no bug, no misclick and no support request can remove a voucher from your books.
We never connect to your bank
There is no bank API integration and no credential to give us. You download the statement yourself and upload the file, so we never hold anything that could be used to access an account.
We cannot reach Tally on our own
The connector runs inside Chrome on your Windows machine and talks to Tally over localhost. Nothing is sent to Tally unless you click, and nothing reaches your Tally from our servers.
We do not decide anything about GST
GSTR-1, GSTR-2A and GSTR-2B exports are read only to draft vouchers for you to review. No reconciliation, no return preparation, no filing and no input-tax-credit eligibility decisions.
Nothing is written until you approve it
Entries are prepared here and stay here until you review them. The first time anything appears in Tally is after you have approved the voucher that created it.
We do not reconcile your bank account
Matching your books against a bank statement is not something this product does. TallyPrime 6.0 rebuilt its own banking and reconciliation, and that is the right place for it.
Reporting a vulnerability
Found a security problem? Email youraiaccountant@taxoneadvisory.com with “Security report” in the subject, the steps to reproduce it and what an attacker could do. We are a small team and read reports during Indian business hours.
In scope: youraiaccountant.in, api.youraiaccountant.in and our Tally Connector Chrome extension. Out of scope: denial of service, social engineering or phishing, physical attacks, and the services we use (Google, Razorpay, Vercel and others), which have their own programmes.
Safe harbour: if you act in good faith, test only against your own account, do not access, modify or keep anyone else's data, and do not degrade the service, we will not take legal action against you for your research.
Disclosure: please give us 90 days to fix the issue before you publish it. We will keep you updated and credit you if you wish.