Security — Golden Tally

Last updated: 2026-10-21

You are trusting Golden Tally with your books, and maybe your bank. This page says, in plain words, how we look after them. We say only what the app does today.

Who can see your books

• Only the people you add. You choose what each person may see, and whether they can look, suggest a change, or change the books.
• Nobody else can open your books. A person on one set of books cannot see another.
• We do not open your books. That is our own rule, and it covers us and our AI helpers. A tool on our computer stops us from reading another person's books by mistake.
• To be honest: no online service can promise that nobody could ever read what is stored on it. Your data sits with our hosting company, Cloudflare, and the account that runs it could technically read it. That is why we protect that account, and why we keep to the rule above.

How you sign in

• You sign in with your email and your password. Your password is kept scrambled. Nobody can read it, not even us. Only you can set it or change it. Nobody on your books can do it for you.
• You can add a second step: a 6-digit code texted to your phone, or shown by an authenticator app. A stolen password alone then does not get in. Before you link a bank, Golden Tally asks you to set one up.
• After several wrong tries, the sign-in waits, and waits longer each time.
• You are signed out after an hour of doing nothing, and after 12 hours at most.
• Everything travels over HTTPS.

Your bank

• Bank links go through Plaid. You type your bank password into Plaid's window. Golden Tally never sees it.
• We keep the key that lets us read your account's name, balance and rows. That key is encrypted, and it stays on the server. It is never sent to a browser.
• You can remove a bank whenever you like. We then ask Plaid to end the link.

QuickBooks

• You connect it through Intuit's own sign-in. We never see your QuickBooks password.
• The connection keys are encrypted and stay on the server.
• We change your QuickBooks only when a person on your books who is allowed to change them asks us to. Every change is recorded, with who made it and when.
• You can disconnect at any time. We then stop reading your books at once.

Your control

• Remove a person. Their access ends at once. Any access key they made stops working at once.
• Remove a bank. See above.
• Delete a whole book. The owner can do this on the Settings page, under Danger zone. It erases the book's data, ends its bank links, disconnects QuickBooks and stops the monthly payment.
• See what happened. The Activity page lists who changed what, and when.

What we do with your data

We do not sell it. We do not use it for advertising. We do not use it to train AI. Your card number goes to Stripe and never reaches us. The Privacy Policy has the full list of what we keep and for how long.

What we do not claim

We are a small company. No outside group has audited us or certified us. We keep our software up to date: we aim to fix a serious weakness within 7 days, and a high one within 30. We would rather tell you what is true than use big words.

Report a security problem

If you think you have found a weakness, or something looks wrong with your books, write to support@mail.goldentally.com. Please do not put your password in the email. We read every message, and we will write back.