Security
How Auditer looks after your books
Your books are your business. This page sets out where your data lives, who can see it, what is encrypted and what stays with you.
Stored in India
Auditer's application servers, database and backups are hosted on Amazon Web Services in the Mumbai region. Each workspace's data is kept separate from every other workspace. Only the companies and financial years you choose in the Auditer Agent are synced.
- Hosted on AWS in Mumbai, India
- Workspaces kept separate
- You choose what is synced
Encrypted in transit and at rest
Traffic between the Auditer Agent, the apps, the web portal and our servers travels over TLS. Cloud backups of your Tally company folders are stored encrypted, and the latest three are kept. Passwords for your GST portal, e-invoice and e-way bill access are encrypted at rest with AES-256-GCM.
- TLS between every app and our servers
- Encrypted backups, latest three kept
- Portal passwords encrypted with AES-256-GCM
Signing in
You sign in with your mobile number and a 6-digit code sent on WhatsApp, valid for 5 minutes and usable once. Turn on PassKey (2FA) to add a 4-digit PIN after the code; the web portal and the apps then ask for it. In the Android and iPhone apps, fingerprint or face unlock can stand in for typing the PIN.
- One-time codes sent only on WhatsApp
- An optional PIN as a second step
- Unused sessions end after 30 days
Roles, data limits and hidden values
Each person gets a role with View, Create and Manage rights for each module, and data limits by company, financial year, ledger, godown and cost centre. Cost price, stock valuation, margin, bank and cash balances, credit limit, tax identity and purchase values can be hidden from roles that do not need them, and show as a dash. Each member can check their own access under My Access.
- Screens a role cannot open are hidden
- Data access set to all, selected or none
- Suspend or remove a member at once
Audit trail and approvals
Every entry made in Auditer is recorded with who made it and its status in TallyPrime: pending, posted or failed. A Hard Sync, which rebuilds the synced data, needs the approval of the Owner or an Admin. Restoring the workspace onto a new PC needs the Owner's approval after a WhatsApp code check.
- A status for every entry
- Approvals for Hard Sync and restore
- Optional entries for review before they count
One Owner, protected
Each workspace has exactly one Owner, who alone can manage billing, transfer ownership, and reset or close the workspace. Transferring ownership needs three email confirmations within 24 hours, followed by a 24-hour grace period in which the Owner can cancel. Resetting or closing a workspace takes the same three confirmations and grace period. You can delete your own account from your profile after confirming a WhatsApp code; deletion cannot be undone.
- Three confirmations for an ownership transfer
- 24 hours to change your mind
- Account deletion confirmed with a WhatsApp code
Your Tally file stays on your PC
The Auditer Agent reads TallyPrime on your PC and posts entries into it; your company files stay there, and TallyPrime remains your books of record. Auditer keeps a synced copy of the data so you can see it elsewhere. Resetting or closing a workspace deletes the synced data and backups held by Auditer, and never touches the Tally files on your PC.
- TallyPrime stays your books of record
- Synced copy deleted on reset or close
- Your Tally files are never touched by a reset
AI, payments and other providers
Ask Auditer and AI insights send only your question, and the summarised figures or help text needed for the answer, to our AI provider, Groq, Inc., in the USA. Payments for credits are handled by Razorpay, and Auditer does not store card or bank details. Every provider that processes data for us, with its purpose and location, is listed on our sub-processors page at /legal/sub-processors.
- AI receives summaries, not your books
- No card or bank details stored by Auditer
- Sub-processors listed publicly
What you look after
Security is shared. Keep the phones and computers that open Auditer locked and up to date, and never share a sign-in code or your PIN. Invite only the people who need access, give each the least they need, and remove them when they leave. The Tally PC holds your company files, so protect it with a Windows password and limit who can use it.
Report a security issue
If you believe you have found a security issue in Auditer, write to [email protected] with the details and the steps to reproduce it. Please do not access, change or delete other people's data while testing, and give us reasonable time to fix the issue before you share it. Our security contact is also published at /.well-known/security.txt.
security.txtFrequently asked questions
Auditer stores your data in India on Amazon Web Services in Mumbai, encrypts it in transit with TLS, and stores backups and government portal passwords encrypted. Each workspace has one Owner, who decides through roles and data limits who sees what. Your TallyPrime company file stays on your own PC.
Where is Auditer data stored?
In India, on Amazon Web Services in the Mumbai region. Backups are stored encrypted.
Does Auditer store my Tally company file?
The original stays on your PC. Auditer keeps a synced copy of the data in the companies you choose and, if you use backups, encrypted copies of the company folders, with the latest three kept.
Is my GST portal password safe in Auditer?
Passwords for the GST portal, e-invoice and e-way bill access are encrypted at rest with AES-256-GCM. They are used only for the actions you or your members ask for.
Can Auditer's AI read my accounts?
Ask Auditer answers from the Help Center and does not read your company books. AI insights send only the summarised figures needed to our AI provider, Groq, in the USA.
Who can see my business data in Auditer?
The members of your workspace, each within the role and data access the Owner gives them. Values such as bank balances and margins can be hidden by role.
How do I delete my data from Auditer?
The Owner can reset or close a workspace, which deletes its synced data and backups, and you can delete your account from your profile settings. Your Tally files on your PC are not touched.