We Don't Just Protect Data. We Respect It.
How your data is protected
Encryption in Transit and at Rest
Connections use TLS. Uploaded files are encrypted at rest by the storage provider. Phone numbers and client contact email are encrypted at the application layer.
Primary Hosting in India
The application and its database run on a dedicated server in Mumbai, and uploaded files are stored in Google Cloud Storage's Mumbai region. Pages are served via Vercel, whose edge also proxies application API traffic between your browser and the Mumbai server and may run at edge locations outside India. Every subprocessor is listed in the Privacy Policy.
Encrypted Off-Site Backups
Every database is dumped nightly, encrypted, and copied off the server to storage it cannot delete from. Thirty days are kept, and one backup is restore-tested every week.
Who can get in
Secure Authentication
Sign in with Google OAuth or email with signed JWT tokens. A sign-in lasts two hours, and an idle session signs itself out after sixty minutes.
Two-Factor Authentication
Add a second step at sign-in: a one-time code sent to your registered email address, with a backup code as fallback if you can't access that email.
Bot and Brute-Force Protection
Every request is rate limited — counted per signed-in user, so one busy colleague cannot lock out the rest of your office — with account lockout after repeated failed sign-in attempts.
Verified Accounts Only
Every account must pass email verification before gaining access. Google sign-in users are verified automatically.
What touches your Tally
Chrome Tally Connector
The Google Chrome extension sends approved requests to Tally on the same Windows computer. Selected results may be stored when required by an application workflow.
Role-Based Team Permissions
Give each colleague only the rights they need — upload, categorise, push to TallyPrime, delete — and limit them to the clients you assign. The server checks this on every request.
Activity Audit Trail
Uploads, ledger changes, deletions, exports and Tally pushes are recorded against the person who made them. Read the trail in Settings, filter it by client or date, and export it.
What you control
Controlled Service Providers
We do not sell customer financial data. Necessary service providers are disclosed in the Privacy Policy.
Full Account Deletion
Request account deletion from Settings. Eligible personal data is erased or de-identified through the process in our Privacy Policy, while records the law requires are retained.
What we cannot do
Limits that are built in, not promised. Each one is a capability the software does not have.
We cannot delete anything in your Tally
Every voucher is sent as a create instruction carrying a fixed reference for its entry, so sending the same voucher again updates it in Tally rather than adding a duplicate. There is no delete instruction anywhere in the connector or the server, so no bug, no misclick and no support request can remove a voucher from your books.
We never connect to your bank
There is no bank API integration and no credential to give us. You download the statement yourself and upload the file, so we never hold anything that could be used to access an account.
We cannot reach Tally on our own
The connector runs inside Chrome on your Windows machine and talks to Tally over localhost, only when you click an action. Nothing runs in the background and nothing reaches your Tally from our servers.
We do not decide anything about GST
GSTR-1, GSTR-2A and GSTR-2B exports are read only to draft vouchers for you to review. No reconciliation, no return preparation, no filing and no input-tax-credit eligibility decisions.
Nothing is written until you approve it
Entries are prepared here and stay here until you review them. The first time anything appears in Tally is after you have approved the voucher that created it.
We do not reconcile your bank account
Matching your books against a bank statement is not something this product does. TallyPrime 6.0 rebuilt its own banking and reconciliation, and that is the right place for it.
Reporting a vulnerability
Found a security problem? Email youraiaccountant@taxoneadvisory.com with “Security report” in the subject, the steps to reproduce it and what an attacker could do. We are a small team and read reports during Indian business hours.
In scope: youraiaccountant.in, api.youraiaccountant.in and our Google Chrome extension. Out of scope: denial of service, social engineering or phishing, physical attacks, and the services we use (Google, Razorpay, Vercel and others), which have their own programmes.
Safe harbour: if you act in good faith, test only against your own account, do not access, modify or keep anyone else's data, and do not degrade the service, we will not take legal action against you for your research.
Disclosure: please give us 90 days to fix the issue before you publish it. We will keep you updated and credit you if you wish.