We receive a token that can read transactions and balances. It cannot move money, change anything, or be used to sign in as you.
Your bank sign-in
Connecting an account opens Plaid, a regulated data provider used by most Canadian fintech. Your banking username and password are entered on your bank's own interface inside that flow. They are never sent to Brasstally, never stored by Brasstally, and cannot be retrieved by us afterwards because we never had them.
If your bank offers a read-only or limited-access option, using it changes nothing about how Brasstally works. We only ever ask to read.
What the token can and cannot do
| Can | Cannot |
|---|---|
| Read transactions on the accounts you selected Read balances on those accounts Tell us when the connection needs re-authorising | Move, send or withdraw money Change anything at your bank Reach accounts you did not select Be used to sign in as you Survive you disconnecting it |
Tokens are held in a table your own session cannot read: the application reads bank data through a server-side function, and the token column is never exposed to the browser.
Disconnecting an account revokes the token with Plaid. Any transactions already pulled into your books stay, because they are your books; delete them individually or reset the ledger if you want them gone.
Who can reach your rows
Every table is protected by row level security in Postgres. That means the scoping is enforced by the database, not by the application remembering to add a filter. If the app had a bug that forgot to restrict a query, the database would still return nothing that is not yours.
Inside our team, access to production data is limited to what is needed to operate the service, and nobody reads your ledger for interest. If you ask us to look at something, we look at that.
Receipts and invoices
Files go into private storage keyed by your user id. They are not public, not guessable, and not served from a public URL. When the app shows you a document it requests a short-lived signed link that expires on its own.
A file stays attached to its entry, because a deduction without its receipt is the first thing an auditor asks about. Deleting the entry deletes the file.
What a model sees
Two things are sent to Anthropic's API:
- A receipt you upload, so the vendor, amount, date and tax can be read off it and the form filled in.
- A question you ask Tally, along with the ledger figures needed to answer it.
Nothing is sent unless you upload a document or type a question. Your ledger is not used to train models. The extraction fills in a form you then confirm, and every field it produces stays editable, because a model reading a crumpled receipt can be wrong and you are the one filing the return.
Tax figures
Tax treatment is derived from your entries every time it is shown, rather than frozen onto a row. Recategorise an entry and its tax line follows. What is stored is only what cannot be recalculated: the tax amount printed on the receipt, which regime applied, and whether you chose to capitalise the purchase.
This matters for a practical reason. A stored conclusion goes stale silently, and then your statement and your ledger disagree with no way to tell which is right.
Business and personal
Ledgers are separate records, not filtered views of one pile. A personal entry cannot appear in a business statement, bank connections belong to the ledger that made them, and resetting one ledger leaves the other untouched.
Getting it out
Every section exports to CSV, and the tax pack exports the whole period: the summary, the figures per CRA line, capital additions, and every entry with its treatment and whether a receipt exists. You do not need to ask us and you do not need an export request. It is a button.
Getting it gone
- One entry: delete it, and its file goes with it.
- One ledger: reset it. Entries and files are removed; other ledgers are untouched.
- Everything: delete your account. Rows and files are removed, and backups roll off within 30 days.
- A bank connection: disconnect it. The token is revoked with Plaid.
If something goes wrong
If personal information under our control is lost or accessed without authorisation in a way that creates a real risk of significant harm, Canadian law requires us to report it to the Privacy Commissioner and to notify you. We will, and we will tell you what happened rather than issuing a statement about how much we value your trust.
What we never do
- Sell your data, or share it for advertising. There is no advertising in Brasstally.
- Use your ledger to train models.
- Ask for your banking password. If anything claiming to be us ever does, it is not us.
- Move your money. The connection is read only, always.
Data is stored in Canada where our providers offer it, and otherwise in the United States. Processing outside Canada can in principle be reached by that country's courts. That is true of essentially every cloud service, and you should know it rather than find out.