Skip to content
Tallyfy

Bring your own encryption key

Administrators only

Holding the key that protects your connections

Section titled “Holding the key that protects your connections”

Tallyfy Vault encrypts every organization’s stored sign-ins. Your organization can supply the key rather than letting Tallyfy pick one. You set it, you rotate it when you want to, and you can destroy it.

These controls sit under Settings then Connections, and you need the admin role to see them.

Your key, in short

Section titled “Your key, in short”

The key is worked out from a salt, and Tallyfy shows you that salt exactly once, at the moment you set or rotate it. Write it down somewhere safe while it’s on screen. Tallyfy keeps only a wrapped copy so unattended work can still run, and it will never show you the salt again or store it in a form anyone can read.

Asking Tallyfy about the key only ever tells you about the key, never the key itself: whether one exists, which version it’s on, and when it was set or last rotated.

Setting the key

Section titled “Setting the key”

Set establishes your organization’s key and returns the salt in the response. Save it. From that point your connections are encrypted under your key.

Rotating the key

Section titled “Rotating the key”

Rotate issues a new salt, shown once like the first, and re-encrypts your organization’s database under the new key.

While that’s running, your organization shows a short Please wait state, and anything asking for a connection gets a “rotation in progress” answer and tries again shortly. If a rotation is interrupted, Vault puts the previous state back when it restarts rather than leaving you with a database that’s half one key and half the other.

Destroying the key

Section titled “Destroying the key”

Delete is the kill switch. It destroys the wrapped copy, which makes your organization’s encrypted store unreadable.

Reach for it when you believe something has gone badly wrong and you want your stored sign-ins to stop being readable immediately.

What you can see as an admin

Section titled “What you can see as an admin”

Under Settings then Connections there’s a usage view, drawn from Vault’s own records. It shows how many calls each app and each person made, how many worked, how many failed, and the state of every connection across your organization.

It holds counts. It never holds a token or any part of one.

What you can rely on

Section titled “What you can rely on”
  • The salt is shown once, and never logged, never stored in readable form, and never returned again.
  • Rotating and deleting are both recorded, with the details of who and when but nothing secret, so your security people can see what happened.
  • A rotation in progress makes reads wait rather than serving a half-rotated database.
  • Deletion is final, by design.
Section titled “Related articles”

Vault > Connect an app

Connect an app to Tallyfy from Settings then Connections, so Tallyfy AI can work in that app as…
Get in touch
About Tallyfy