How BlackTally handles your data
BlackTally helps accounting firms collect client documents. Client documents are sensitive, so here is exactly how they're handled. This page describes our current practices for transparency — it is not legal advice or a warranty.
How data is stored
- In transit: all traffic is served over HTTPS/TLS.
- At rest: client documents live in Cloudflare R2 and application data in Cloudflare D1 — both encrypted at rest by Cloudflare.
- Secrets: API keys and signing secrets are stored as encrypted Worker secrets. Deploys use a scoped API token, not a full account login.
- Credentials: we never ask for or store your bank or tax-software (Drake, Lacerte, ProConnect, UltraTax) credentials.
- Upload links: the no-login client upload links are per-request, expiring, write-only, and rate-limited.
- Recovery: the database supports point-in-time recovery.
Your data rights
- Export: download your full account data as JSON, and any request as a PDF, anytime from your dashboard.
- Delete: delete your firm and all its data yourself from Settings — documents are removed from storage.
- We don't trap your data to retain you — retention should come from the product being useful, not from lock-in.
Your compliance obligations
Tax preparers who handle taxpayer data have obligations under the IRS Safeguards Rule (Publication 4557), the FTC / GLBA Safeguards Rule, and are required to maintain a written information security plan (WISP). BlackTally is a tool that supports good document-handling practices; it is not a substitute for your firm's own WISP, and using it is not a guarantee of compliance. You remain responsible for your clients' data.
Automated reminders honor opt-outs. SMS reminders, when enabled, follow applicable consent requirements (TCPA).
BlackTally is software — not a law firm, compliance consultant, or a substitute for professional advice. This page is provided for transparency and may change as the product evolves.