A private server per company
No other business logs in to your Windows server. Your licence and data sit on it together, as Tally's rules require.
Security, backups and data location
Is Tally on Cloud safe? How we protect your books
Is Tally cloud safe? It is a fair question when your accounts move to someone else's server. So here is every control we use, the evidence you can ask for, and how to check each one yourself, without having to take our word for it.
- One private server per company
- Data kept in Mumbai, India
- Two-factor login
- Daily automated backups
Quick answer
Is Tally cloud safe? Yes, if your provider can prove its controls. At TallyoCloud, each company gets a private Windows server in Mumbai, India, reached only through an encrypted gateway with two-factor login. Backups stay in India with a separate locked copy, staff access is approved and logged, and you can download your own backup whenever you want.
The short answer
Eight controls that make Tally on Cloud safe, and how yours compares
Any Tally cloud provider, including us, should be able to show you all eight. Tick the ones your office PC or current provider already has, and you'll see exactly where the gaps are.
Data kept in India
The server and every backup copy are in Indian data centres, and the facility is named in writing.
No open Remote Desktop port
Port 3389 is closed to the internet. Every session comes through an encrypted gateway on port 443.
Two-factor login
Each person has their own login and a second factor on their phone, so a stolen password alone is useless.
Encrypted, separate backups
Backups are encrypted and stored away from the server, including one copy that can't be altered or deleted early.
Restores that are tested
Backups are restored in drills and opened in TallyPrime, so we know they work before you ever need one.
Logged, approved staff access
Engineers open your server only for a request you've approved, and every admin session is recorded.
Clear exit terms
You can download your data at any time, and the terms say what you get, and when it's deleted, if you leave.
0/8
Tick what your office PC or current provider already does to see what's missing.
Comparing providers? Our 12-point Tally cloud provider checklist adds licensing, pricing and support questions to these eight.
Architecture
From your screen to your backups, layer by layer
Tap each layer to see what we do there, the evidence you can ask us for, and how to check it yourself.
Control
You connect with Microsoft's free Windows App on a Mac, iPhone, iPad or Android, or with Remote Desktop Connection on Windows. The session carries keystrokes one way and screen updates the other. Your company data folder never lands on the device.
Evidence
Nothing is installed on your device except the Remote Desktop app. If a laptop or phone is lost, tell us and we disable that login and reset its second factor; the device holds no books to leak.
Verify it
Read Microsoft's Windows App overview, then see which app to use on each device in our Tally RDP guide.
Control
Every connection arrives at a Remote Desktop Gateway that encrypts the channel and listens on port 443. Network Level Authentication means you sign in before a Windows session is even created, a second factor is required, and idle sessions time out.
Evidence
Your connection file names our gateway, and the second-factor prompt appears at every login. Ask us for your server's firewall rules: only gateway traffic is allowed in.
Verify it
Microsoft describes how the gateway role works in Remote Desktop Services roles. Any online port checker will show port 3389 closed on your server's address.
Control
One Windows Server virtual machine per company, in Mumbai, India. Your TallyPrime licence and data sit on it together. The server is patched on a schedule and watched by endpoint detection software, with no other customer's users on it.
Evidence
Your quote states the processor, memory and storage your server gets. The Windows user list is yours to review with us at any time, and every name on it is someone you asked us to add.
Verify it
Tally's Tally Virtual User FAQ explains why licence and data share one machine. Server sizes and isolation are on our Tally cloud server page.
Control
Daily automated backups of the whole server with 30-day retention, TallyPrime's own Auto Backup to a separate disk, and an encrypted copy in a second Indian location that is locked against changes and early deletion.
Evidence
Ask for your server's backup log and the date of its last restore drill. Company customers also get a provider-details letter for their annual filing.
Verify it
Take your own backup from TallyPrime at any time and restore it on any Windows PC. Tally documents the scheduled Auto Backup we use.
Control
Our engineers reach your server only for a request you've approved, through the same gateway and second factor. Every admin session is logged, and logs are kept for 180 days in India. We never ask for your Tally.NET password.
Evidence
Ask for the admin access log for your server over any period: who connected, when, for which request and for how long.
Verify it
The 180-day log rule comes from India's CERT-In Directions of 28 April 2022. How we handle personal data is in our privacy policy.
New to how this works? What is Tally on Cloud? explains the idea in plain words.
Data location
Where is Tally cloud data stored? In India, and named.
Your server runs in a data centre in Mumbai, India, and every backup copy stays in India too. Your data doesn't leave the country, not even for backups.
- The facility, in writing. We name the data-centre facility in your quote. Ratings and certificates belong to the facility's operator, so we point you to the operator's own certificate rather than printing a tier badge here.
- Backups in a second Indian location. A fire, flood or power failure at one site doesn't take your only copy with it.
- Right for your licence. Tally's licensing best practices say a licence must be used mainly, at least 75%, in the region it was bought for. Indian licences belong on Indian servers.
- Right for company and tax law. Companies, and from 1 April 2026 most businesses that keep books electronically, must back them up daily on servers in India, as the next sections explain.
Backups and restore
Four copies of your books, one of them in your hands
A single backup protects against a single kind of failure. We keep copies at four levels, each covering something the others don't.
| Layer | Protects you against | Where it lives | How long |
|---|---|---|---|
| 1. TallyPrime Auto Backup | A wrong deletion, a bad import or one damaged company | A separate disk on your server | Daily and incremental; Tally's default keeps 7 versions, up to 366 |
| 2. Server snapshot | A failed update, a broken server, a mistake across many companies | Backup storage in India, off the server | Daily automated backups, 30-day retention |
| 3. Locked copy | Ransomware, a misused admin account, a problem at one site | A second location in India; can't be changed or deleted before it expires | Depends on your plan (see pricing) |
| 4. Your own copy | Any provider problem, including us, or simply deciding to leave | Your computer or drive | As long as you like |
Restore drills, not hope
A backup that has never been restored is a guess. We restore backups in drills, open the company in TallyPrime and check that it loads, not just that a file exists. Ask us when your server's backups were last test-restored.
Tally's own Auto Backup, added in Release 7.0, only runs if the machine is switched on at the scheduled time. An office PC that's off at night misses it. A cloud server doesn't.
If you need to roll back
- Tell us the company and the date you need, on WhatsApp or by phone.
- We restore that point into a separate folder, never straight over live data.
- You check the trial balance and vouchers in the restored copy.
- We swap it in, or you copy across only the entries you need.
Download your Tally data whenever you like
You don't need our permission to take a copy. In TallyPrime 7.0 or later, press Alt+Y (Data), choose Backup & Restore, then Backup, and save it to your own computer's drive, which shows up inside the Remote Desktop session.
The full how-to, including TallyDrive, Google Drive and older releases, is in our Tally data backup guide.
Company and tax law
Daily backups in India: Companies Rules and Income-tax Rule 46(8)
If your business is a company, the Companies (Accounts) Rules, 2014, as amended on 5 August 2022 (G.S.R. 624(E)), set three requirements for books kept electronically:
- Rule 3(1): the books must stay accessible in India at all times.
- Rule 3(5): a backup must be kept on servers physically located in India, every day.
- Rule 3(6): each year, with its financial statements, the company tells the Registrar the service provider's name, IP address and location, and the cloud address where books are kept.
For company customers we provide a signed provider-details letter with exactly those items, plus a daily-backup log your auditor can file. These Companies Act rules bind only companies; proprietorships, partnerships and professionals are covered by the Income-tax rule alongside. CA firms handling corporate clients will find more on our CA firms page.
Income-tax Rule 46(8) extends this to most businesses. From 1 April 2026, Rule 46(8) of the Income-tax Rules, 2026 requires anyone who keeps books of account electronically under the Income-tax Act, 2025 to keep them accessible in India and take a daily backup on servers located in India. The Income Tax Department's Form No. 26 FAQs add that tax auditors must report the server's IP address and country and the address of the India backup server. Tally Solutions' summary explains who it covers. Our daily backups stay in India, and your tax auditor can ask us for the server details; your CA can confirm how the rule applies to you. See our Rule 46(8) guide for the notified text and what auditors ask for.
Audit trail stays on
Companies have had to keep an audit trail that can't be disabled since 1 April 2023. TallyPrime's Edit Log release does this, and it runs on our servers exactly as it does on a PC.
Access control
Who can see your accounts? Only the people you choose.
Access is controlled at two levels: who can log in to the server, and what each person can do inside TallyPrime.
- A login per person. Every user gets their own Windows account and second factor. No shared passwords, so you always know who did what, and removing a leaver takes one message.
- TallyPrime security levels. Tally's user management lets the owner give a data-entry operator voucher entry only, hide reports, and block back-dated changes before a cut-off date.
- TallyVault, if you want it. TallyVault encrypts a company, including its name, with a password only you know. We can't open it, and Tally warns that a forgotten TallyVault password means losing the data for good, so store it safely.
- Our access is consented and logged. An engineer connects only for a request you've approved, and every session is recorded with time, person and purpose.
- Your Tally.NET password stays yours. When your licence moves to the server, you type your own Tally.NET details on a screen-share. Tally's surrender steps are the same ones we walk you through during data migration.
Ransomware and patching
How ransomware reaches Tally data, and how we close each door
The usual story goes like this: an office PC has its Remote Desktop port forwarded to the internet, a password gets guessed, and the attacker encrypts the Tally data folder along with the USB drive that held the only backup. Every control below breaks a link in that chain.
No open door
Port 3389 is closed to the internet. Attackers would first have to pass the gateway, Network Level Authentication and a second factor.
Patched on a schedule
Microsoft releases Windows security updates every month. We install them in planned maintenance windows, announced in advance, and urgent fixes don't wait. Maintenance terms are in our SLA.
Behaviour is watched
Endpoint detection and response software looks for ransomware-like activity, such as mass file encryption, and stops it, alongside antivirus with the exclusions Tally recommends for its data files.
Isolated by design
One company per server means a problem on one server can't spread to the next, and no other customer's users share your machine.
Backups attackers can't touch
The locked copy can't be changed or deleted before it expires, even with an admin password. The worst case becomes a restore, not a ransom.
Nothing to steal from a laptop
Your books aren't stored on staff laptops or phones, so an infected or stolen device doesn't take your company data with it.
Using AnyDesk or a forwarded port to reach an office PC today? Our Tally remote access comparison lays out the risks of each option.
Customer verification
Why we check who you are before giving you a server
India's CERT-In Directions require cloud and VPS providers to record validated details about every customer and keep them for five years after the service ends. It also means nobody can rent a server from us anonymously.
So our sign-up, including the free trial, asks for these details before any server is created. We collect only what the rule needs, and we never ask for card details for a trial.
What the rule asks us to record
- Validated name of the customer hiring the service
- Validated address and contact numbers
- Ownership pattern: individual, partnership, company and so on
- Purpose of hiring the service, and the period of hire
- IP addresses allotted to you
- E-mail address, IP address and time stamp used at sign-up
Compliance commitments
The rules we work to, stated plainly
There's no "CERT-In certificate" or "DPDP certificate" to hang on a wall. What exists are obligations, so here is each one and what we do about it.
| Rule | What it requires | What we do |
|---|---|---|
| CERT-In Directions, 28 Apr 2022: incidents | Report listed cyber incidents, including ransomware and data breaches, to CERT-In within 6 hours of noticing them | A written incident process with 6-hour reporting; affected customers are told directly |
| CERT-In Directions: logs | Keep logs of all ICT systems securely for a rolling 180 days, within India | Gateway, server and admin-access logs kept 180 days in India |
| CERT-In Directions: clocks | Sync system clocks to NIC or NPL time servers, or sources traceable to them | Server clocks synced, so log times can be matched up in an investigation |
| CERT-In Directions: customers | Record validated customer details and keep them for 5 years after the service ends | Collected at sign-up; nothing beyond what the rule lists |
| Companies (Accounts) Rules r.3(5) and 3(6) | Daily backup of electronic books on servers in India; yearly provider details to the Registrar | Daily backups in India; provider-details letter and backup log for companies |
| Income-tax Rules 2026, r.46(8) | From 1 April 2026, books kept electronically must stay accessible in India, with a daily backup on servers in India; tax auditors report the server details in Form No. 26 | Daily backups in India; server IP address, location and backup details on request for your tax audit |
| DPDP Act 2023 and Rules 2025 | Most duties, including security safeguards and breach notices, apply from 13 May 2027 | We already work to that standard: we process data in your books only on your instructions, and processor terms are available on request |
Sources: CERT-In Directions under section 70B(6) of the IT Act; Companies (Accounts) Fourth Amendment Rules, 2022, as reproduced by ICAI; Income-tax Rule 46(8) as summarised by Tally Solutions and the Income Tax Department's Form No. 26 FAQs; DPDP Rules timeline as reported by Bar & Bench. Our handling of personal data is in our privacy policy.
About certificates. We list a certificate only if we actually hold it, with its number, issuing body, scope and expiry, so you can check it yourself, for example on IAF CertSearch for ISO certificates. None is listed here today. Data-centre ratings belong to the facility operator, so ask us for the facility's name and its own current certificates. Be wary of any provider whose badges you can't look up.
Data ownership and exit
Your books stay yours, including the day you leave
Your companies stay in standard TallyPrime format, and your licence stays in your business's name. Nothing about our setup locks you in.
- Any time: take a backup from TallyPrime and save it to your own computer. No ticket, no fee.
- When you cancel: we hand over a complete copy of your data folder and help you surrender the licence on our server.
- After you leave: as our terms set out, we keep your server untouched through the 30-day retention period after your last paid day, in case you need anything else, then delete it securely.
- Somewhere new: reactivate your licence on any Windows PC or with another host, and restore your backup there.
Cancelling is as easy as signing up: a WhatsApp message or an e-mail is enough. Refund rules are in our refund policy.
| TallyoCloud | TallyPrime Cloud Access | |
|---|---|---|
| Download a backup while subscribed | Yes, any time, to your computer | Yes, as password-protected zip files¹ |
| Backups after the service ends | Full copy handed over; server kept through the 30-day retention period after your last paid day, then deleted | 7 days after expiry (backup page) or 30 days from deactivation (FAQ)¹ |
| Where data is hosted | Mumbai, India | Region not stated in Tally's FAQ¹ |
| Login | Windows login and second factor via gateway | Tally.NET ID and Secure PIN¹ |
¹ Tally Solutions' Cloud Access backup page and Cloud Access FAQ, both updated 29 Sep 2026; the two pages give different figures. TallyoCloud is an independent host, not Tally Solutions. The full side-by-side is in TallyPrime Cloud Access vs Tally on Cloud.
Check it for yourself
Get the security pack, no form to fill
If your IT person, auditor or CA wants it in writing, e-mail us and we'll send our security overview and a sample provider-details letter. No sign-up, no sales call unless you ask for one.
Support 7 days a week. Prefer to call? +91 97168 56953, or see every option on our contact page. Who we are is on our about page, and the full list of what's included is on features.
Reviewed 2026-10-10
Reviewed by the TallyoCloud Cloud Team against these sources. We update this page when a rule or a Tally page changes.
FAQ
Tally cloud security FAQ
Is Tally on Cloud safe for my accounts?
Yes, when the provider can show its controls instead of just claiming them: your data kept in India, a private server for your company, no open Remote Desktop port, two-factor login, encrypted backups with a separate locked copy, tested restores and logged staff access. TallyoCloud explains each control on this page, names the data-centre facility in your quote and lets you download your own backup whenever you like.
Where is my Tally data stored?
On your private Windows server in a data centre in Mumbai, India, with backup copies in a separate location that is also in India, so your data does not leave the country. We name the facility in your quote. The Companies (Accounts) Rules and, from 1 April 2026, Income-tax Rule 46(8) require daily backups of electronic books on servers in India, and Tally says Indian licences must be used mainly in India.
Can your staff see my accounts?
Only when you allow it. An engineer opens your server for a specific request after you approve it, and every admin session is logged. We never ask for your Tally.NET password: licence moves happen on a screen-share while you type. For extra privacy, TallyPrime's TallyVault encrypts a company with a password only you know, but Tally warns that a forgotten TallyVault password means the data is lost for good.
How do I download my Tally data from the cloud?
Open TallyPrime on your server, press Alt+Y (Data), choose Backup & Restore and then Backup, and save the file to your own computer's drive, which appears inside the Remote Desktop session. You can do this at any time without asking us. We can also hand over a full copy of your data folder. Our Tally data backup guide covers every option step by step.
What happens to my data if I stop the service?
You can download a full backup at any time, before or after you give notice. When you cancel, we hand over a complete copy and, as our terms set out, keep your server untouched through the 30-day retention period after your last paid day, then delete it securely. For comparison, Tally's pages give two figures for its own Cloud Access: 7 days after expiry on its backup page, and 30 days from deactivation in its FAQ.
Is Tally on Cloud safer than Tally on an office PC?
It depends on how each one is run. An office PC can be safe if it has tested off-site backups, current Windows updates and no Remote Desktop port open to the internet, but many have none of these. A managed cloud server builds them in, along with two-factor login and logged staff access. Cloud does make you depend on the internet and on your provider, so check backups and exit terms first.
Related pages
Tally cloud server
Private VM or dedicated host: published vCPU and RAM, one company per server.
See server optionsTally RDP
Which Remote Desktop app to use on each device, and how Tally counts RDP users.
How you connectCloud Access vs Tally on Cloud
Tally's own hosted service and ours, compared honestly on devices, printing, price and backups.
Compare bothTally data backup guide
TallyDrive, Google Drive or cloud: how to back up and restore TallyPrime, step by step.
Read the guideChoosing a provider
Twelve questions to ask any Tally cloud host before you move your books.
Get the checklistWhat is Tally on Cloud?
The idea in plain words: how it works, what it costs and its honest limits.
Start here
Setup within one business day
Move your Tally to the cloud this week.
Buy your Tally RDP server and we migrate your company data, set up your users and walk everyone through their first login. Want to test first? Try it free for 7 days.