Is TallyMint safe? How your data is protected
Short answer: yes, and the details differ depending on which version you use, so this page covers both plainly. With TallyMint for Windows, your financial data never leaves your computer: it lives in an encrypted file on your own machine, opened with your master password, with no cloud account and no telemetry, so there is no online database of your finances to break into. With TallyMint Web, your data is on our servers, because that is what makes a browser app work, and this page explains exactly how it is protected and what we can and cannot do with it.
The Windows app: your data stays on your computer
TallyMint stores all of your accounts, transactions, budgets, categories, and reports on your own PC. We do not run servers that hold your financial data, and we cannot read, access, or recover it, because we never receive it in the first place. You decide where your TallyMint folder lives and how it is backed up.
Encryption, and exactly what it covers
A vague answer is not much use on a page like this, so here is the specific one:
- Your ledger file is encrypted on disk with AES-256. Accounts, transactions, budgets, payees, balances, the whole database rather than a field here and there. A copy of that file is unreadable without the key, in TallyMint or in anything else.
- The key sits in a small key file beside the ledger, wrapped with AES-256-GCM so that only your master password can unwrap it. The two files are one ledger between them, which is why copying your ledger means taking the folder and not the data file on its own.
- Argon2id turns your master password into the key that does the unwrapping. Argon2id is a modern, memory-hard password hashing algorithm designed to resist brute-force attacks, and your password itself is never stored.
- Your saved bank credentials and license data are encrypted a second time with their own AES-256-GCM keys inside the ledger, so even a decrypted copy does not hand over working bank access.
- A recovery key is the only way back from a forgotten master password, and you set it up yourself in Settings. It is shown once and stored nowhere. Without one, a forgotten password means nobody can open the ledger, including us.
What the Windows app sends over the network
The desktop app is designed to be quiet. The only times it talks to the internet are:
- License activation: a one-time request to validate your license key when you enter it. After that, the license is cached locally and TallyMint does not phone home on every launch.
- Bank sync (only if you opt in): TallyMint calls the SimpleFIN API directly from your computer to download transactions. Your bank credentials are never routed through our servers.
- Update checks: TallyMint checks for new versions. These requests contain your version and platform only, never any user or financial data.
No tracking, no analytics
Neither version includes advertising or usage-profiling analytics, and we have nothing to sell to third parties. The desktop app sends no telemetry at all. The website uses Microsoft Clarity for anonymized visitor analytics, disclosed in our privacy policy.
You stay in control
With the desktop app, your data sits in a folder on your own machine, so you own your backup and recovery strategy. You can copy that folder, keep it in Google Drive or OneDrive, or park it on an external drive. Copy the whole folder rather than picking the data file out of it: the key file next to it is what makes the ledger openable, and a data file that arrives without it cannot be opened again. If you ever stop using TallyMint, your data does not vanish into a closed cloud account, it stays right where you put it. Our backups guide covers the details.
TallyMint Web: how a hosted ledger is protected
TallyMint Web keeps your data on our infrastructure. That is a real difference from the desktop app and we are not going to soften it, so here is precisely how it works.
- Bank access is read-only. Connections run through Plaid with read permissions for balances, transactions, and investment holdings. TallyMint has no ability to move money, initiate payments, or change anything at your bank. That is not a promise about our behavior, it is the limit of the access we hold.
- Your bank credentials never reach us. You log in to your bank on Plaid's own secure screen. We receive an access token, never your username or password.
- Those tokens are encrypted at rest with AES-256-GCM under a key held separately from the data, so a copy of the database alone does not yield working bank access.
- Accounts are isolated at the database level. Every table holding customer data has row-level security enforced by the database itself, keyed to the signed-in account, and the application's database role cannot bypass it. Isolation does not depend on application code remembering to filter correctly.
- Your identity is never client-supplied. Who you are is derived server-side from your signed-in session on every single request, so a request cannot ask for someone else's data by claiming to be them.
- Everything is encrypted in transit over TLS, and the database is encrypted at rest by our hosting provider.
- Sign-in is handled by a dedicated identity provider (Clerk), which supports Google sign-in and emails you when a new device signs in to your account. We never store your password.
- Payments never touch our servers. Card details go to Dodo Payments, our payment processor. We store only your subscription status and their customer reference.
- You can always leave with your data. Export your entire ledger to QIF or CSV whenever you want, including after cancelling, and realized capital gains to TXF for tax software.
We are one independent developer, not a bank, and we do not pretend to hold enterprise audit certifications we have not been through. What we will do is tell you exactly how the system works, keep the access we hold to the minimum the product needs, and give you a version that stays entirely on your own machine if that is what you would rather have.
Which one should you pick, security-wise?
If your threat model is "I do not want my financial history on anyone else's server", the answer is the Windows app, unambiguously. Nothing about the hosted version can beat data that never leaves your house. If your concern is more ordinary, that your finances be encrypted, isolated from other customers, unable to move your money, and exportable on demand, TallyMint Web is built to that standard, and it buys you access from any device.