How Your Financial Data Is Protected

Tally Assistant holds your transactions, invoices, and receipts. This page states exactly what we do with that data: who can reach it, how it is encrypted, what happens when it goes to an AI model, and what is logged when anything changes.

Found a vulnerability? Email [email protected] with the subject "Security report" and reproduction steps. We acknowledge reports within 48 hours.

Authentication & Sessions

  • Sign-in is handled by Clerk, a dedicated authentication provider. We never see or store your password.
  • Sessions use HttpOnly, Secure cookies that JavaScript cannot read, protected against XSS.
  • OAuth authorization flows use a state parameter signed with a server-side secret, so login requests cannot be forged.
  • Inbound webhooks (Clerk, cron, IndexNow) require signature verification or a shared secret. Unsigned requests are rejected with 401.

Data Isolation

  • Every database row is scoped to its owner with Supabase row-level security, and every API route re-checks ownership server-side.
  • A transaction, invoice, or time entry from tenant A is rejected before it can be read or written by tenant B.
  • OAuth access tokens and refresh tokens are encrypted at rest with AES-256-GCM using a dedicated key, and decryption fails closed if the key is missing.
  • User-controlled URLs (like business logo uploads) are validated against DNS rebinding and redirect attacks before they are fetched.

Encryption

  • All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
  • Encryption keys live in environment variables on the hosting platform, never in the repository.
  • Files you upload (receipts, screenshots, CSV) are stored in private storage buckets, not publicly readable.

AI Data Handling

  • AI processing (CSV parsing, receipt OCR, invoice generation) runs through OpenAI's API with training disabled. Your data is never used to train AI models.
  • API inputs and outputs are automatically deleted after 30 days.
  • Each AI request processes only the data you sent for that request, nothing else.

API & Webhook Hardening

  • AI endpoints and feedback endpoints are rate-limited per user to stop abuse and cost attacks.
  • CSV exports sanitize formula injection: a merchant named =HYPERLINK(...) cannot execute inside your spreadsheet.
  • Upload parsing (xlsx and friends) is capped in size and depth so a malicious file cannot exhaust memory.
  • Every email we send (reminders, invoices, notifications) HTML-escapes its content, closing injection through user data.

Audit & Backups

  • Every create, update, and delete is recorded in an append-only audit log with timestamp, user ID, entity, and before/after values. See the audit log feature page.
  • The database is backed up automatically every day on AWS US West, with point-in-time recovery available.
  • Deleted accounts keep data for a 90-day recovery window, after which it is permanently deleted.

Related Trust Pages

Privacy Policy

What we collect, how it is used, and your rights.

Audit Log

Every action recorded with timestamp, user, and before/after values.

Methodology

How we measure and verify every number we publish.

Security Questions

Do you sell or share my financial data?

No. We do not sell personal or financial data. Data is shared only with the service providers needed to operate the product (Clerk for auth, Supabase for storage, OpenAI for AI features, Resend for email, Paddle for payments), each under its own processing agreement. See the privacy policy for the full list.

Is my data used to train AI models?

No. The OpenAI integration is configured with training disabled, and API inputs and outputs are automatically deleted after 30 days.

What happens to my data if I delete my account?

Your data is retained for a 90-day recovery window after deletion or cancellation, then permanently deleted. Backup copies may persist up to 30 additional days.

Have you run security tests?

Yes. We run automated security scanning against every major release covering the OWASP top categories (authentication, authorization, injection, SSRF, rate limiting, secrets handling), fix what is found, and re-scan to verify. This is a real finding-tracking process, not a marketing certificate. We do not claim penetration-test certifications we do not have.

How do I report a security issue?

Email [email protected] with the subject 'Security report'. Include the affected URL or endpoint, a description of the issue, and reproduction steps. We acknowledge reports within 48 hours and keep you updated on the fix.