Security and privacy

Local network boundary

The cloud never opens a connection to the merchant computer. The Windows Agent initiates outbound HTTPS requests for pairing, heartbeat, commands, results, and diagnostics. It contacts TallyPrime only at http://127.0.0.1:9000.

The Agent accepts allow-listed typed commands and generates XML locally. It does not execute cloud-supplied XML or TDL.

Credentials

Windows refresh credentials are protected with DPAPI for the current signed-in user. The cloud stores refresh-token hashes, not reusable plaintext refresh tokens. Refresh credentials rotate with compare-and-set protection.

Command data

Command payloads and results are encrypted in PostgreSQL with AES-256-GCM. Authentication endpoints use request-size limits and Redis-backed rate limits.

Logging and diagnostics

The Agent's rotating logs exclude access tokens, refresh tokens, credentials, customer contact data, and raw Tally responses. Cloud operational health is an aggregate, merchant-safe summary rather than a raw command viewer.

Retention

• Eligible terminal command payloads/results are removed after seven days by the maintenance worker. Unresolved voucher writes, successful vouchers still awaiting durable accounting evidence, and commands needed by active scans remain until their safety conditions are resolved. Seven days is not a blanket maximum for those exceptions.
• Eligible identifier-only webhook and sync operational records are removed after 30 days. Unresolved voucher-related sync records can remain longer.
• Webhook bodies are authenticated in memory; only the required identifiers are stored.

Customer privacy requests

Shopify customer access and deletion requests appear under Customer privacy in the app. The cloud maintenance worker processes them every minute when it is running; failed or blocked requests stay visible with their 30-day deadline.

Access requests produce an encrypted export of matching stored order/command and accounting data. An authenticated merchant can download it, securely deliver it to the requesting customer, and confirm delivery. Downloading alone does not mark a request fulfilled. Export copies expire 30 days after receipt, and overlapping deletion requests invalidate and remove them.

Deletion removes matching eligible cloud commands (including shipping details and results), accounting links/evidence, reservations, activity records, and associated audit entries. Queued voucher writes are cancelled before deletion. An in-flight or unresolved Tally write must first be reconciled in Orders & refunds; until then deletion remains blocked, not complete. This safety hold does not extend the privacy deadline or establish a legal retention right. Escalate blocked requests to the merchant's privacy/support owner promptly.

Minimal request metadata and order-ID suppression records remain until shop redaction to prevent re-importing erased orders. New exports and refunds for those orders are blocked. Whole-shop redaction also removes these records and Shopify sessions.

The connector does not automatically delete vouchers or alter books in the merchant's local Tally company. The merchant must separately review local copies, customer disclosures, backup retention, and any legally required retention with their privacy/accounting owner. Any restored cloud backup must replay applicable redactions before service resumes.

Support data

Safe support data can include Agent/Tally versions, reachability, company GUID, command IDs, sanitized error codes/messages, queue timestamps, and aggregate scan progress. Do not send order bodies, names, addresses, emails, phone numbers, payment identifiers, tokens, decrypted commands, raw Tally responses, source rows, or integrity digests.