Is TallyMint safe? How your data is protected
Yes. With TallyMint for Windows, your financial data never leaves your computer: it lives in an encrypted file on your PC, opened with your master password, with no cloud account and no telemetry. With TallyMint Web, your data is on our servers, and this page shows exactly how it is protected.
| TallyMint for Windows | TallyMint Web | |
|---|---|---|
| Where your data lives | An encrypted file on your PC | Our servers, encrypted and isolated per account |
| Bank access | Read-only, through SimpleFIN or OFX Direct Connect, only if you opt in | Read-only, through Plaid |
| Your bank password | Never reaches us | Never reaches us |
| Telemetry | None | No advertising or usage-profiling analytics |
| Leaving | Your folder stays where you put it | Export everything to QIF or CSV, even after cancelling |
The Windows app: your data stays on your computer
Your accounts, transactions, budgets and reports live on your own PC. We never receive them, so we cannot read, access, or recover them.
Encryption, and exactly what it covers
- Your ledger file is encrypted on disk with AES-256. The whole database, not a field here and there. A copy of that file is unreadable without the key, in TallyMint or in anything else.
- The key sits in a small key file beside the ledger, wrapped with AES-256-GCM so that only your master password can unwrap it. The two files are one ledger between them, which is why copying your ledger means taking the folder and not the data file on its own.
- Argon2id turns your master password into the key that does the unwrapping. It is memory-hard, built to resist brute-force attacks, and your password itself is never stored.
- Your saved bank credentials and license data are encrypted a second time with their own AES-256-GCM keys inside the ledger, so even a decrypted copy does not hand over working bank access.
- A recovery key is the only way back from a forgotten master password, and you set it up yourself in Settings. It is shown once and stored nowhere. Without one, a forgotten password means nobody can open the ledger, including us.
What the Windows app sends over the network
The desktop app talks to the internet only for:
- License checks: your key is verified when you activate it, and again in the background each time you unlock a licensed ledger. The check sends only the license key and its activation ID, never financial data. If no check succeeds for 7 days, the app turns read-only until one does.
- Bank sync (only if you opt in): TallyMint connects to SimpleFIN, or to your bank through OFX Direct Connect, directly from your computer. Your bank credentials are never routed through our servers.
- Price quotes (only if you add a quote key): the ticker symbols to price and your key go straight to the quote provider you chose, at most once a day when you unlock, or when you click Refresh prices.
- Update checks: TallyMint checks for new versions. These requests contain your version and platform only, never any user or financial data.
- Reports you send: bug reports and feedback reach us only when you send one.
No tracking inside the apps
Neither version includes advertising or usage-profiling analytics, and we have nothing to sell to third parties. The desktop app sends no telemetry at all. The marketing website, and the web app's sign-up page and sample demo before you sign in, use Microsoft Clarity for visitor analytics, disclosed in our privacy policy. Once you are signed in, no analytics or session recording runs.
You stay in control
With the desktop app, your data sits in a folder you choose. Copy it, keep it in Google Drive or OneDrive, or park it on an external drive, but copy the whole folder: the key file beside the data file is what makes the ledger openable. The backups guide has the details.
TallyMint Web: how a hosted ledger is protected
TallyMint Web keeps your data on our infrastructure.
- Bank access is read-only. Connections run through Plaid with read permissions for balances, transactions, and investment holdings. TallyMint has no ability to move money, initiate payments, or change anything at your bank.
- Your bank credentials never reach us. You log in to your bank on Plaid's own secure screen. We receive an access token, never your username or password.
- Those tokens are encrypted at rest with AES-256-GCM under a key held separately from the data, so a copy of the database alone does not yield working bank access.
- Accounts are isolated at the database level. Every table holding customer data is isolated by the database itself, keyed to the signed-in account, and the application cannot bypass it.
- Your identity is never client-supplied. Who you are is derived server-side from your signed-in session on every single request, so a request cannot ask for someone else's data by claiming to be them.
- Everything is encrypted in transit over TLS, and the database is encrypted at rest by our hosting provider.
- Sign-in is handled by a dedicated identity provider, which supports Google sign-in and emails you when a new device signs in to your account. We never store your password.
- Payments never touch our servers. Card details go to Dodo Payments, our payment processor. We store only your subscription status and their customer reference.
- You can always leave with your data. Export your entire ledger to QIF or CSV whenever you want, including after cancelling, and realized capital gains to TXF for tax software.
We are one independent developer, not a bank, and we do not claim audit certifications we have not been through. We tell you exactly how the system works and hold only the access the product needs.
Which one should you pick, security-wise?
If you do not want your financial history on anyone else's server, pick the Windows app. If you want it encrypted, isolated, unable to move money, exportable, and reachable from any device, TallyMint Web is built for that.