Encrypted everywhere
TLS 1.3 between your browser and us, AES-256 for everything we store, and separate keys for backups.
Security and trust
Your numbers, kept carefully.
Invoices, bank transactions and client details are the most sensitive data a small business has. Here’s exactly how we look after them, in plain English.
- Data stored inDublin, Ireland
- Backup copy inFrankfurt, Germany
- Uptime, last 12 months99.97%
- Last independent testAugust 2026
How we protect it
Six things we never cut corners on.
Kept in the EU
Your data lives in Dublin with an encrypted copy in Frankfurt. It isn’t moved outside the EU.
Read-only bank feeds
Regulated open banking connections that can read transactions and nothing else. No banking passwords, ever.
Two-factor and passkeys
Authenticator apps and passkeys on every plan. Owners can require them for the whole team.
Hourly backups
Point-in-time backups every hour, kept for 35 days and restored as a test every month.
A full audit trail
Every invoice edit, payment match and export is logged with who did it and when.
Privacy
Your data is yours.
We process your clients’ details only to run Tally for you. We don’t sell data, show ads or train anything on your invoices.
- Data processing agreement included in our terms
- A named data protection officer in Cork
- Export or delete everything from your settings
Sub-processors
The companies that help us run Tally and what they handle.
| Company | Purpose | Location |
|---|---|---|
| Stratus Cloud | Hosting and backups | Ireland, Germany |
| Openlink | Regulated bank connections | Ireland |
| Puffin Pay | Card payments on invoices | Ireland |
| Postbox Mail | Sending invoices and reminders | Netherlands |
| Helpdesk Nord | Support conversations | Denmark |
Responsible disclosure
Found a problem? Tell us first.
Email security@tally.example with the details. We reply within one working day, keep you updated while we fix it and credit you if you’d like.
Do you have an independent security test?
Yes. An outside firm tests the app and our infrastructure every year; the latest was in August 2026. Practice customers can ask for the summary report.
Who at Tally can see my data?
Only support staff you give permission to, for the length of a support conversation. Every access is logged and appears in your audit trail.
What happens to my data if I leave?
Your account stays read-only so you can export everything. When you ask us to delete it, it’s gone from live systems straight away and from backups within 35 days. Keep your own copy for as long as the law requires you to keep business records.