Security & data retention

Emerald Tally reads your bank transactions to keep your books. It can never move money. Here is how we protect that data, who can reach it, and how long we keep it. This page summarizes our Information Security, Access Control, and Data Retention and Deletion policies.

Encryption

• Everything travels over HTTPS with TLS 1.2 or higher, including our connections to Plaid, our database and every provider.
• All data is encrypted at rest, including the database, file storage and backups.
• Bank connection tokens get an extra layer of AES-256 encryption inside our application. They are never sent to any browser or app, including yours.

Bank connections through Plaid

• We connect to your bank through Plaid. You sign in to your bank inside Plaid; we never see or store your bank username or password.
• Our access is read-only. We request transactions only, and we can never move money.
• Disconnect a bank at any time in Accounts. We revoke the connection at Plaid and destroy its token immediately.

Who can access your data

• You decide who on your side sees it. Invite an accountant with read-only or edit access to only the businesses you choose, and remove them at any time. Every request is checked against your ownership and their role.
• Inside Emerald Tally, access is limited to the few people who need it. Every admin account uses its own login with multi-factor authentication. Access is approved individually, reviewed every quarter, and removed within 24 hours when someone leaves. We look at customer data only to help you when you ask, or to investigate a security problem.
• Your account: sign in with single-use email links that expire in 15 minutes, and turn on two-factor authentication in Settings → Security.

How we run things

• Every code change is tested automatically before release, and every release can be rolled back in seconds.
• Dependencies are scanned for known vulnerabilities continuously and every week. We patch critical issues within 7 days and high-severity issues within 30.
• Sign-ins, role changes, bank connections and edits to your records are logged.
• We use established providers that publish their security practices: Plaid, Vercel, Neon, Anthropic, Resend, Twilio and Stripe. See our privacy policy for what each one handles.
• If a security incident affects your data, we will notify you without unreasonable delay, and within the time the law requires.

How long we keep your data

We keep your records for up to 7 years because the IRS can generally ask about a tax return for that long. Everything else is kept for a shorter, fixed period.

Deleting your data

• Delete your account in Settings → Data. You have 30 days to change your mind or export everything. After that, your data is permanently deleted from our database and file storage, your bank connections are revoked at Plaid, and backups age out within 30 more days.
• Export everything at any time from Settings → Data, on every plan.
• Ask us to access, correct or delete your data by emailing privacy@emeraldtally.com. We confirm it's you, then complete the request within 30 days.

Report a security issue

Found a vulnerability? Email privacy@emeraldtally.com with the subject "Security report." We will respond within 3 business days. Please don't access other people's data or disrupt the service while testing.

Our full policies

Banks, partners and business customers can request our complete Information Security, Access Control, and Data Retention and Deletion policies by emailing privacy@emeraldtally.com. Each is reviewed at least once a year.