You are handing us your financial records. Here is how we treat them.
Most bookkeeping services ask for your bank login and store years of your data in a platform you do not control. We do neither. This page is the whole picture, not a badge.
The short version
We never ask for bank logins
Statements only. We have no access to your accounts and cannot move money. If someone claiming to be us ever asks for banking credentials, it is not us.
Encrypted uploads, never email
Statements come in through Box, which uses TLS 1.3 in transit and AES 256-bit encryption at rest and is SOC 2 Type II and ISO 27001 certified. We do not accept client financial documents by email.
We only ever take three fields
From each statement we extract the date, the description and the amount of each transaction. Your account numbers, routing numbers and balances are never extracted and never leave your statement.
Your data never trains AI models
We work under business agreements that prohibit it, on accounts we control. No client information is used to improve anyone's model.
Raw statements are deleted
Once your books are finalized and delivered, the source files are removed from our systems. We keep your finished financials, not your statements.
Access is limited
Two-factor authentication everywhere, and anyone working on your account sees only the clients they are assigned to.
What actually happens to a statement.
- You upload it to your own folder in our portal. It is encrypted in transit and at rest.
- We pull the transaction rows out of it: date, description, amount. The header, your name, your address and your account numbers are never copied forward.
- The rows are scrubbed against a list specific to you, so anything identifying that made it into a description gets replaced before anything else happens.
- An automated check searches the cleaned file for your name, account numbers and address. If it finds any, the file stops and a person looks at it.
- Only then are the cleaned rows categorized.
- Your books are built, checked, and delivered to your folder.
- The source statements are deleted.
We do not connect to your bank. No Plaid, no aggregators, no stored credentials. It is slightly more work for you at upload time and considerably less risk for both of us.
A security plan you can actually read.
We maintain a written information security plan covering access control, device security, data retention, vendor review and what happens if something goes wrong. It is available to any client on request, and we ask the same of the vendors we use.
Tally Quarter is operated by Tax GPS Group LLC, which carries professional liability and cyber liability insurance.
The two things that matter on your end.
Use the portal, not email
Emailing a statement puts an unencrypted copy of your financial life in two inboxes forever. We will always ask you to upload instead.
Tell us when someone leaves
If a bookkeeper, assistant or partner had access to your account with us, let us know and we will remove it the same day.
Security questions
Where is my data stored?
Your documents are stored in the United States.
Who can see my books?
Only the people working on your account: whoever prepares your books and whoever reviews them before delivery. Nobody else at Tally Quarter or Tax GPS Group has access unless you ask us to add them.
Do you sell or share my information?
No. We do not sell, rent or share client information with anyone for marketing, and we never use client data in our own marketing.
What happens if you have a breach?
We notify affected clients promptly with what we know, what was affected and what we are doing, and we follow the notification requirements that apply. Our security plan defines the process before we need it.
What if I stop being a client?
Your finished financials stay available to you for seven years, and you can ask us to delete everything sooner. Files you have downloaded are yours forever either way.
Questions we did not answer here?
Ask on the call. We would rather over-explain this than have you wondering.
Book a 20-minute call