Security & backups
How Airmax protects your Tally data
Hosted Tally data is protected by four things working together: the physical and network security of a Tier 3 data centre, multi-layer firewalls in front of the server, SSL-encrypted Remote Desktop sessions, and a one-time password required at every single login. On top of that, automated backups run daily, and you can schedule your own independent copy to storage you control. This page explains each layer and, just as importantly, what each one does not cover.
The four layers, and what each one is for
| Layer | What it protects against |
|---|---|
| Tier 3 data centre | Physical access to the hardware, and single points of failure in power and cooling. Your server is not a box under a desk. |
| Multi-layer firewall | Unwanted network traffic reaching the server at all. Only the ports needed for a Remote Desktop session are exposed. |
| SSL-encrypted session | Anyone between you and the data centre reading what is on your screen or what you type — on office Wi-Fi, a hotel network or mobile data. |
| OTP on every login | A stolen or guessed password being enough on its own. Without the one-time code, the correct password still does not open a session. |
Why the one-time password matters most
Of the four layers, OTP verification is the one that addresses the way accounting systems are most often compromised in practice. Data centres are rarely broken into and encrypted traffic is rarely intercepted, but passwords are shared between colleagues, reused across services and typed into the wrong window every day.
Requiring a one-time code at each login means a leaked password is not, by itself, access. It also means that when a member of staff leaves, revoking their account genuinely ends their ability to open your books — there is no saved copy of the data on their old machine to fall back on, because there never was one.
Where your data physically sits
Your Tally installation and company data live on a server in a Tier 3 data centre, not on the laptops and desktops your team uses. This is a security property in its own right: the most common way small businesses lose accounting data is not an attack but a failed hard disk, a stolen laptop or a machine that was quietly the only place a company's books existed.
Because each user opens the same copy on the server, there is also only one place to secure, back up and audit — rather than one copy per machine, each with its own risk profile.
How backups actually work
There are two independent layers, and the second one is the one worth paying attention to.
- Automated daily backups run on the server itself, managed by Airmax. These are what a restore normally comes from.
- A control panel lets you schedule your own copy of the Tally data to Google Drive, OneDrive, Dropbox or Amazon S3 — storage that belongs to you, not to us.
- You can also take a backup down to your own PC whenever you want, using the same panel.
We recommend configuring the second layer even though the first exists. A backup regime where one organisation holds every copy is a single point of failure regardless of how well that organisation runs it, and an independent copy under your own control costs you nothing but the storage.
What this does not cover
Being straight about the boundaries is part of a security description being useful:
- Access control inside Tally remains yours to manage. If a user is given rights to a company in Tally, the cloud layer will not second-guess that.
- Anyone who has both a valid login and the one-time code is treated as a legitimate user. Shared credentials defeat the protection, so give each person their own login.
- The device you connect from is outside our perimeter. A machine with malware on it is a risk to any system that person signs in to, hosted or local.
- Compliance obligations that apply to your business — how long you retain records, who may see them — stay with you. The Terms and the Privacy Policy set out how that responsibility is divided.
Where the formal commitments are written down
Marketing pages are not contracts. The binding statements about service availability, data handling and responsibility live in the terms and conditions and the privacy policy. If something on this page matters to your decision, check that it is reflected there, and ask us if it is not.
Questions about how your data would be handled?
Security questions are best answered directly. Call or email the Airmax team and ask about your specific situation before you commit.