Security at TallyWeek

Transport

Every page, API call and file download is served over HTTPS. Plain HTTP requests are redirected to HTTPS. Session cookies are marked secure in production, so they are only ever sent over an encrypted connection.

Accounts and sessions

• Passwords are hashed by the authentication service. TallyWeek never stores or logs a plain-text password, and we cannot read yours.
• Password resets go through a one-time link sent to the email address on the account.
• Your sign-in session is kept in a cookie and checked on every request. Signing out clears it.

Authorization on every write

Access control is enforced in the application layer, on the server, for every request that changes data. The user interface hides what you cannot do, but it is the server that decides.

• Workspace roles: Owner, Admin, Member, Guest. Each role's abilities are set in a per-workspace permission matrix that the owner controls.
• Board roles: Owner, Editor, Contributor, Viewer. A private board exists only for the people it is shared with; everyone else gets a not-found response, not a permission error.
• Guests can only see the boards they are shared on.
• The same checks apply whether a request comes from the web app, the REST API or the MCP server. There is no separate, weaker path for integrations.

API keys

• The full key is shown once, at creation. Only its SHA-256 hash is stored, so a copy of our database does not reveal working keys.
• A key acts as one named workspace member and is limited to the scopes you choose (read, items:write, items:delete, updates:write, structure:write, structure:delete, boards:write, boards:delete, members:manage). It can never do more than that member could do in the app.
• Keys can be revoked from Workspace settings by anyone with the right permission. A revoked key stops working immediately.

Details are in the API documentation.

Payments

Card details are entered on, and handled by, the payment provider named on your receipt. Card numbers never pass through or rest on TallyWeek servers. See the Refund and Cancellation Policy for how billing works.

Files

Uploaded files are kept in the platform's storage and served only through TallyWeek's own file endpoint, which requires a signed-in session. Browsers are never given direct storage URLs. Uploads are limited to 25 MB per file.

Third-party scripts

The application does not load third-party analytics, advertising or tracking scripts. What we do collect, and which providers process it, is listed in the Privacy Policy.

What we do not claim

We do not hold security certifications such as SOC 2 or ISO 27001, we do not publish uptime figures, and there is no service-level agreement on the Free or Pro plans. If your organisation needs specific contractual commitments, ask us about the Business plan through the contact page.

Reporting a vulnerability

If you believe you have found a security issue in TallyWeek, email info@airoxlab.com with the subject line "Security". Include steps to reproduce and, if possible, the affected workspace or URL. We acknowledge every report within 1 business day and keep you informed while we fix it. Please do not test against workspaces you do not own, and do not access or change other people's data while investigating; see the Acceptable Use Policy.