Security, specifically
What we do, what we don't, and what is still in progress. Written for the person who has to sign off on it.
How your books are kept
TLS 1.2 or newer for everything in transit. AES-256 for everything at rest, including backups.
Handled by Stripe and never stored on our servers. We see the last four digits and nothing else.
Read-only, through Plaid. Tallybird can see deposits to match payments. It cannot move money.
Two-step sign-in with an authenticator app, required for owners and finance roles, optional for others.
An audit log of every send, edit, approval and export, kept for two years and exportable.
Daily, kept for 35 days, in a second US region. We test a full restore every month.
A SOC 2 Type II audit window opens in March 2027. Until the report exists, we don't claim it, and we share our controls list on request.
Your data, your call
Export every invoice, client and payment as CSV and PDF at any time. Close your workspace and we delete it within 30 days and email you when it's done. We don't sell data, and California residents can make access or deletion requests from Settings.
Who else touches your data
| Company | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting and backups | United States |
| Stripe | Card and bank payments | United States |
| Plaid | Read-only bank feeds | United States |
| Postmark | Invoice and reminder email | United States |
| Twilio | Text message reminders, if you turn them on | United States |
We email owners 30 days before adding anyone to this list. Found a problem? Write to [email protected]; a person replies within one business day, and we don't take legal action against good-faith research.