Signing in to Tallycon: what it sends and what it keeps
Coming This guide describes Tallycon accounts, which open with our hosted service. Until then it is a preview.
You don't have to sign in
Tallycon works without an account. With your own Anthropic API key, the app talks to Tally on your network and to Anthropic, and nothing on this page applies to you.
You sign in when your firm uses Tallycon seats. Your questions then go through Tallycon's metering proxy instead of your own key, and your firm decides who sees which clients.
What signing in sends
You sign in with your email address. Tallycon emails you a 6-digit code, and you type it into the app. The code lasts 10 minutes and allows 5 tries. There is no password.
When you sign in, the app sends:
| What | Why |
|---|---|
| Your email address | To find your account and send you the code |
| The 6-digit code | To prove the address is yours |
| An installation id: a random number the app makes when it is installed | So the server knows which installation it is talking to. It is not tied to your computer's hardware or serial number |
| A name for this computer, such as "Asha's ThinkPad" | So you and your partners can tell your devices apart |
| This computer's public key | So another computer of your firm can hand it the firm key safely (see below). It is a public key. The private half never leaves the computer |
| The app version and the platform (Windows or Mac) | So the service knows which version it is talking to |
After that, the app renews its sign-in when it starts and about every 15 minutes while you use it, sending the installation id and the app version.
Signing in sends nothing from your books: no company names, ledgers, vouchers, questions or answers.
The sign-in code is emailed through a mail service (Postmark). The service handles your email address and the code in order to deliver them.
What Tallycon's server keeps
| Kept | Not kept |
|---|---|
| Your firm's name, your email address and your role | Your books, questions, answers, vouchers or conversations |
| Your devices: their names, public keys, when they were added and when they were last seen | Your clients' names |
| Your firm's licence and seats | The firm key (only a locked copy, see below) |
| Which client ids each person may use | The sign-in code in readable form (only a fingerprint of it, which cannot be turned back into the code) |
| Usage: who asked, when, which model, how many tokens and what it cost, against a client id |
Client ids are numbers, not names. Each client is identified by a code that your firm's computers work out from the client's name with your firm's own key. The server sees the code, never the name. So when a partner gives Ravi access to Sharma Traders, the server records that Ravi may use client 9f2c… and nothing more. Your partners see the names in the app, because the app works them out again on your firm's computers.
The firm key is never readable on the server. A partner's computer makes the key when your firm first signs in. When someone in the firm signs in on a new computer, a computer that already holds the key locks a copy so that only the new computer can open it, and the server passes that locked copy on. The server cannot open it.
Before the copy is sent, a partner checks a short code such as K7QM-2XRA on both screens, the one sending the key and the new computer. The two codes must match. This stops anyone, including someone who has broken into the server, from slipping in a computer of their own. If the codes differ, the handoff is refused and every partner gets an email.
The server's logs record the time, what was called, whether it worked, and which firm, person and device asked. They never record an email address, a sign-in code, a token, a key or a list of clients.
Who sees what: roles
Every person in your firm's account has one of three roles.
For a CA firm:
- Partner. Runs the firm's account. Sees every client. Invites staff and owners, gives them seats, chooses which clients each of them can use, and removes devices. Only partners hand the firm key to a new computer.
- Staff. Accountants and article assistants. Sees only the clients a partner has assigned to them. If Ravi works on Sharma Traders and two other clients, those three are all he can ask about, open or export.
- Owner. A client's business owner, invited by the firm. Sees only their own business. Mr Sharma can ask about Sharma Traders and nothing else the firm looks after.
For a business running Tallycon itself: the people who run the account are partners, the accountants and the rest of the accounts team are staff, and the owner can be a partner or an owner.
Access is checked in three places: in the app, in the office copy of Tallycon before it reads Tally for someone asking from outside, and on the server before a question reaches the AI. When a partner removes someone's access, the server refuses it at once. The person's app catches up within 15 minutes.
Owners asking from outside the office. Most owners ask from their own laptop through remote access. The office reads Tally only after checking that the person asking may see that business. The question is billed to the owner's seat, not the office's.
Devices
Each seat can be signed in on up to 3 computers. You can see your devices and remove any of them, including the one you are using. A partner can remove anyone's device. A removed device is cut off at once: it cannot ask another question, and the next time it checks in it deletes its sign-in and its copy of the firm key.
Signing out stops the computer from asking. It still counts as one of your 3 devices until you remove it.
When you're offline
Tallycon checks your firm's licence each time it renews your sign-in. If it cannot reach the server, it keeps working on the last licence it received for up to 7 days:
- Up to 7 days offline: the app opens. Saved conversations, the GST page, reading Tally and exports all work. Asking needs the internet, so Ask says you are offline.
- After 7 days offline: only saved conversations and exports open, until the app reaches the server again.
- If the firm's licence has ended: the same as after 7 days, and the app says the licence has expired.
Setting the computer's clock back does not stretch the 7 days. The app remembers the latest time it has seen, and if the clock goes backwards it says so and keeps counting from that latest time.
If you never sign in, none of this applies. A copy using its own API key has no licence to check.
What stays the same
Signing in changes nothing about where your books are read or kept. Tallycon still reads Tally only on your office network and never writes to it. Conversations, the question log and GSTR-2B files still stay on your own computers. The data for each question still goes to the AI service (Anthropic), passing through Tallycon's proxy, which keeps no copy.