Skip to content
Tallyfy
Developers

HSTS compliance

HSTS (HTTP Strict Transport Security) forces your browser to use encrypted connections only. It blocks any attempt to connect to Tallyfy without HTTPS - even if someone tricks you into clicking an http:// link, your browser upgrades it automatically.

How does HSTS work?

Section titled “How does HSTS work?”

When you first visit Tallyfy over HTTPS, your browser receives a Strict-Transport-Security header. This header tells your browser to connect to Tallyfy only over HTTPS.

Your browser remembers this for one year1. If you type http:// instead of https:// in that time, the browser switches to HTTPS before it sends any data.

How does Tallyfy use HSTS preloading?

Section titled “How does Tallyfy use HSTS preloading?”

Tallyfy is on the HSTS preload list2, which is built into Chrome, Firefox, Safari, and other major browsers. Your browser knows to use HTTPS with Tallyfy before you’ve ever visited. The list’s own site, hstspreload.org, shows tallyfy.com as “preloaded”.

What attacks does HSTS prevent?

Section titled “What attacks does HSTS prevent?”
  • SSL stripping3: Attackers try to downgrade your connection to plain HTTP, but your browser has already switched to HTTPS before any data leaves your device.
  • Man-in-the-middle exploits: If someone sits between you and Tallyfy and pretends to be us, your browser refuses any connection that isn’t verified and encrypted.
  • Session hijacking: Login cookies and authentication tokens only travel encrypted. That matters most on public Wi-Fi, where someone on the same network could otherwise copy them and sign in as you.
  • Eavesdropping: Network admins, ISPs, and nearby devices can’t read your clicks, form submissions, or the documents you view in Tallyfy, because all of it is encrypted.

What are HSTS requirements?

Section titled “What are HSTS requirements?”

Tallyfy’s setup meets each of these:

  1. Valid TLS/SSL certificate. This proves you’re connecting to the real Tallyfy, not an imposter.
  2. Automatic HTTPS redirection. Any HTTP request gets a permanent redirect to HTTPS (http://go.tallyfy.com/ goes to https://go.tallyfy.com/), which is why the HSTS header always reaches you over a secure connection.
  3. All resources over HTTPS. No mixed content: every image, script, and other resource loads over HTTPS.
  4. Secure header delivery. Tallyfy only sends the HSTS header over HTTPS. Sending it over HTTP would let attackers modify it.

Three more requirements live in the header itself. Both tallyfy.com and go.tallyfy.com send strict-transport-security: max-age=31536000; includeSubDomains; preload. A max-age of one year is the minimum the preload list accepts. includeSubDomains applies HSTS to every Tallyfy subdomain, such as go.tallyfy.com and account.tallyfy.com, and preload is the directive the list requires before it adds a site.

Section titled “Related articles”

Pro > Compliance

Tallyfy maintains a current SOC 2 Type 2 attestation. Bank-level encryption (TLS 1.2+ and…

Footnotes

Section titled “Footnotes”

  1. Max-age value of 31536000 seconds (one year) in the Strict-Transport-Security header ↩

  2. A Google-maintained list of sites hardcoded into browsers. Even your first visit is protected ↩

  3. Attack technique that forces HTTPS connections to downgrade to unencrypted HTTP ↩

Get in touch
About Tallyfy