Is TallyMint safe? How your data is protected
Yes. With TallyMint for Windows, your financial data never leaves your computer: it lives in an encrypted file on your PC, opened with your master password, with no cloud account. With TallyMint Web, your data is on our servers, and this page shows exactly how it is protected.
| TallyMint for Windows | TallyMint Web | |
|---|---|---|
| Where your data lives | An encrypted file on your PC | Our servers, encrypted and isolated per account |
| Bank access | Read-only, through SimpleFIN or OFX Direct Connect, only if you opt in | Read-only, through Plaid |
| Your bank password | Never reaches us | Never reaches us |
| Usage tracking | Trial check-ins only; never your ledger | No advertising or usage-profiling analytics |
| Leaving | Your folder stays where you put it | Export everything to QIF or CSV, even after cancelling |
The Windows app: your data stays on your computer
Your accounts, transactions, budgets and reports live on your own PC. We never receive them, so we cannot read or recover them.
Encryption, and exactly what it covers
- Your ledger file is encrypted on disk with AES-256. The whole database, not a field here and there. A copy of that file is unreadable without the key, in TallyMint or in anything else.
- The key sits in a small key file beside the ledger, wrapped with AES-256-GCM so that only your master password can unwrap it. The two files are one ledger between them, which is why copying your ledger means taking the folder and not the data file on its own.
- Argon2id turns your master password into the key that does the unwrapping. It is memory-hard, built to resist brute-force attacks, and your password itself is never stored.
- Your saved bank credentials and license data are encrypted a second time with their own AES-256-GCM keys inside the ledger, so even a decrypted copy does not hand over working bank access.
- A recovery key is the only way back from a forgotten master password, and you set it up yourself in Settings. It is shown once and stored nowhere. Without one, a forgotten password means nobody can open the ledger, including us.
What the Windows app sends over the network
The desktop app talks to the internet only for:
- License checks: your key is verified when you activate it, and again in the background each time you unlock a licensed ledger. The check sends only the license key and its activation ID, never financial data. If no check succeeds for 7 days, the app turns read-only until one does.
- Bank sync (only if you opt in): TallyMint connects to SimpleFIN, or to your bank through OFX Direct Connect, directly from your computer. Your bank credentials are never routed through our servers.
- Price quotes (only if you add a quote key): the ticker symbols to price and your key go straight to the quote provider you chose, at most once a day when you unlock, or when you click Refresh prices.
- Update checks: your app version, license type, a few one-time install flags, and a random install number made on your PC, not derived from your computer, license key or ledger. That is how we count installs and purchases.
- Trial check-ins and error reports: once a day during and after the trial, that install number, the trial day and whether a bank is connected (yes or no); and an automatic report when something breaks, never with ledger data. Every detail is in our privacy policy.
- Reports you send: bug reports and feedback reach us only when you send one.
No advertising trackers
Neither version includes advertising trackers, and we sell no data to anyone. The marketing website, and the web app's sign-up page and sample demo before you sign in, use Microsoft Clarity for visitor analytics, disclosed in our privacy policy. Once signed in to TallyMint Web, no analytics or session recording runs.
You stay in control
With the desktop app, your data sits in a folder you choose. Keep it in Google Drive, OneDrive, or on an external drive, but always copy the whole folder: the key file is what makes the ledger openable. The backups guide has the details.
TallyMint Web: how a hosted ledger is protected
TallyMint Web keeps your data on our infrastructure.
- Bank access is read-only. Connections run through Plaid with read permissions for balances, transactions, and investment holdings. TallyMint has no ability to move money, initiate payments, or change anything at your bank.
- Your bank credentials never reach us. You log in to your bank on Plaid's own secure screen. We receive an access token, never your username or password.
- Those tokens are encrypted at rest with AES-256-GCM under a key held separately from the data, so a copy of the database alone does not yield working bank access.
- Accounts are isolated at the database level. Every table holding customer data is isolated by the database itself, keyed to the signed-in account, and the application cannot bypass it.
- Your identity is never client-supplied. Who you are is derived server-side from your signed-in session on every single request, so a request cannot ask for someone else's data by claiming to be them.
- Everything is encrypted in transit over TLS, and the database is encrypted at rest by our hosting provider.
- Sign-in is handled by a dedicated identity provider, which supports Google sign-in and emails you when a new device signs in to your account. We never store your password.
- Payments never touch our servers. Card details go to Dodo Payments, our payment processor. We store only your subscription status and their customer reference.
- You can always leave with your data. Export your entire ledger to QIF or CSV whenever you want, including after cancelling, and realized capital gains to TXF for tax software.
We are a software company, not a bank, and we do not claim audit certifications we have not been through. We explain exactly how it works and hold only the access the product needs.
Which one should you pick, security-wise?
If you do not want your financial history on anyone else's server, pick the Windows app. If you want it encrypted, isolated, unable to move money, exportable, and reachable from any device, TallyMint Web is built for that.
Frequently asked questions
Is TallyMint safe to use?
Yes. The Windows app keeps your ledger in an encrypted file on your PC that never reaches us, opened with your master password. TallyMint Web keeps your data on our servers, encrypted and isolated per account. Bank access is read-only in both, so TallyMint can never move money.
Does TallyMint send my financial data anywhere?
The Windows app does not upload your financial data. Nothing you do in your ledger is reported to us. Its network requests are license checks carrying your key and its activation ID, bank sync and price quotes only if you set them up, update checks that we count by app version and license type, with a random install number so we can count trials that become purchases, a daily check-in during and after the trial, automatic error reports, and reports you choose to send. TallyMint Web necessarily stores your ledger on our servers, since that is what makes a browser app work, and it is never sold or shared.
Can TallyMint move money out of my bank account?
No. Bank access is read-only in both versions. TallyMint can read balances, transactions, and investment holdings, and it has no ability to move money, make payments, or change anything at your bank.