Your financial data,
protected at every layer
Security is foundational to Tally. From the moment you create your account to every bank connection you make, your data is encrypted, isolated, and guarded by industry-leading practices.
Your Account Security
Multiple layers of protection keep your account safe from unauthorized access.
Bcrypt password hashing
Passwords are hashed with bcrypt (industry-standard one-way hashing) — we never store or see your password in plaintext.
Two-factor authentication
Available via time-based one-time passwords (TOTP). Your TOTP secret is encrypted at rest with AES-256-GCM, and 16 bcrypt-hashed backup codes are provided for account recovery.
Short-lived sessions
Access tokens expire every 15 minutes and are automatically refreshed with a 7-day refresh token. Refresh tokens are stored as bcrypt hashes, so even a database breach wouldn't expose active sessions.
Google Sign-In
Supported via OAuth 2.0 with Google's ID token verification — we never handle your Google password.
Strong password requirements
Passwords must be at least 10 characters with uppercase, lowercase, and a number. Password reset tokens are single-use and expire after one hour.
Rate limiting
Authentication, token refresh, and contact form endpoints all have dedicated rate limiters to prevent brute-force and abuse.
Bot protection
Google reCAPTCHA v3 protects registration from automated abuse.
Connecting Your Financial Accounts
We integrate with Plaid and SnapTrade — both are industry-leading financial data aggregators trusted by thousands of apps.
- We never see your bank credentials. When you connect an account, you authenticate directly with Plaid or SnapTrade through their secure widget. Your bank username and password are exchanged only between you and the aggregator.
- AES-256-GCM encryption at rest. All access tokens are encrypted using the same standard used by banks and government agencies. Each token gets a unique initialization vector, and the encryption key is stored separately in Google Secret Manager — not in our database or codebase.
- Every token type is encrypted. This applies to Plaid tokens, SnapTrade secrets, and Google Sheets tokens (for Tiller users) — all encrypted before touching our database.
- Webhook signatures are verified. Incoming data from Plaid is cryptographically verified using ES256 JWT signatures with body hash validation. Replay attacks are blocked via deduplication.
Infrastructure & Data Protection
Defense in depth — from the network edge to the database layer.
HTTPS everywhere
All traffic is encrypted in transit via TLS with HSTS preload enabled, ensuring browsers always connect over HTTPS. Our backend runs on Google Cloud Run with automatic HTTPS enforcement.
No raw SQL
We use Prisma ORM exclusively, which parameterizes all queries and eliminates SQL injection risks.
Strict input validation
All input is validated with strict schemas (Zod) before processing — protecting against injection and malformed data.
Security headers
Helmet.js and nginx enforce protections against clickjacking, XSS, MIME sniffing, and downgrade attacks on every response — including static assets.
Secret management
Secrets (database credentials, API keys, encryption keys) are managed through Google Secret Manager and injected at runtime — never stored in code or version control.
Error monitoring
Real-time error monitoring catches issues instantly, and production error messages are generic to prevent information leakage.
Security at a glance
Your bank credentials never touch our servers. All sensitive tokens and two-factor secrets are AES-256 encrypted at rest. Passwords are one-way hashed with strong requirements enforced. Sessions are short-lived and securely stored. Bank webhooks are cryptographically verified. The entire platform runs on Google Cloud with HSTS, enterprise-grade secret management, and hardened containers.