Security and data protection
How Tallied Books keeps practices’ and their clients’ information safe, and who can see it.
Each practice kept apart
Every practice record carries its workspace. The application filters by it, and the database’s row-level security refuses anything outside the signed-in workspace, so a missed check is refused rather than leaked.
Who can see what
Your staff see what their role allows. Your clients see only their own documents and requests. Our support team sees nothing unless one of your administrators grants a support session, and what they do is in your audit log.
A person approves every record
Nothing is posted to Xero or Sage until someone at your practice approves it.
Signing in
One login and password serve your practices, each with its own workspace session. Access tokens last ten minutes and sessions can be ended at once. Five wrong passwords lock your shared login for fifteen minutes. A password change or reset ends its sessions everywhere. Session cookies cannot be read by scripts, and changes are protected against cross-site requests.
Encryption and logs
Information is encrypted in transit and at rest, and PDF passwords and accounting connection tokens are encrypted again before they are stored. Our logs hold identifiers, never document contents, figures, account numbers or passwords.
POPIA
Your practice is the responsible party for its memberships and workspace records, and we are its operator. We are the responsible party for your shared login and sign-in records. The data processing agreement is the written agreement sections 20 and 21 of POPIA require, the sub-operator register lists who else processes information and where, and the privacy notice explains our responsibilities.
Report a concern
If you think information in Tallied Books has been exposed, or you have found a weakness, email privacy@talliedbooks.co.za. Please do not test it on a workspace that is not yours.