How TallyFolio reduces unnecessary access
TallyFolio handles sensitive personal finance records, so the product is built around minimizing unnecessary access and keeping financial calculations deterministic.
No bank credentials required
TallyFolio does not ask for bank usernames, passwords, or direct account-linking tokens. Financial records enter the product through manual entry or CSV import under your control.
User-scoped data
Workspace data is scoped to your authenticated account. Row-level security policies limit access to records owned by the signed-in user.
CSV import control
Uploaded files are parsed in memory for import and are not retained as standalone file storage inside the product workflow described for beta use.
No offline copies
The app never caches your financial data in the browser for offline use.
Outbound requests are the exception, not the rule
The app talks to your own Supabase project and nothing else, with two optional features that are off unless you turn them on: the AI report explanation, and re-downloading a fund provider's published holdings file. The holdings fetch accepts only HTTPS addresses on an allowlist of fund providers, re-checks every redirect, caps the response size, and sends none of your accounts, balances, or holdings.
Deterministic financial calculations
Totals, budgets, forecasts, and reports are produced by explicit rules in the application code — not by opaque model guesses about your balances.
Private assets
Private assets are tracked separately from everyday cash-flow accounts so holdings like gold, crypto, receivables, or collectibles do not get mixed into spending totals unless you record a transaction.
Responsible reporting
If you suspect a security issue, report it through the app or via Contact the TallyFolio team from your account. Include enough detail to reproduce the concern without sharing unnecessary sensitive financial data in public channels.