Skip to content
Tallyfy
Developers

Bring your own encryption key

Administrators only

Holding the key that protects your connections

Section titled “Holding the key that protects your connections”

Tallyfy Vault encrypts every organization’s stored sign-ins automatically. It creates your organization’s key the first time your organization uses Vault, so there’s nothing to set up and nothing to wait for.

If you’d rather hold a key you have the recovery salt for, press Rotate key. It replaces the automatic key with a new one and shows you that key’s recovery salt once. You can also destroy the key.

These controls sit under Settings then Connections, and you need the admin role to see them.

Your key, in short

Section titled “Your key, in short”

The automatic key has no recovery salt you can see. A key made by Rotate key is worked out from a salt, and Tallyfy shows you that salt exactly once, at the moment the key is made. Write it down somewhere safe while it’s on screen. Tallyfy keeps only a wrapped copy so unattended work can still run, and it will never show you the salt again or store it in a form anyone can read.

Asking Tallyfy about the key only ever tells you about the key, never the key itself: whether one exists, which version it’s on, and when it was created or last rotated.

Rotating the key

Section titled “Rotating the key”

Rotate key replaces your current key with a new one. It makes a new recovery salt, shows it once, and re-encrypts your organization’s database under the new key. It’s also how you swap the automatic key for one you hold the salt for.

While that’s running, your organization shows a short Please wait state, and anything asking for a connection gets a “rotation in progress” answer and tries again shortly. If a rotation is interrupted, Vault puts the previous state back when it restarts rather than leaving you with a database that’s half one key and half the other.

Setting a key when there’s none

Section titled “Setting a key when there’s none”

Set organization key only shows when your organization has no key yet. That’s rare, because Tallyfy creates one the first time your organization uses Vault. It creates the key and shows its recovery salt once, like Rotate key does.

Destroying the key

Section titled “Destroying the key”

Delete key is the kill switch. It destroys the wrapped copy, which makes your organization’s encrypted store unreadable.

Reach for it when you believe something has gone badly wrong and you want your stored sign-ins to stop being readable immediately.

What you can see as an admin

Section titled “What you can see as an admin”

Under Settings then Connections there’s a usage view, drawn from Vault’s own records. It shows how many calls each app and each person made, how many worked, how many failed, and the state of every connection across your organization.

It holds counts. It never holds a token or any part of one.

What you can rely on

Section titled “What you can rely on”
  • The salt is shown once, and never logged, never stored in readable form, and never returned again.
  • Rotating and deleting are both recorded, with the details of who and when but nothing secret, so your security people can see what happened.
  • A rotation in progress makes reads wait rather than serving a half-rotated database.
  • Deletion is final, by design.
Section titled “Related articles”

Vault > Connect an app

Connect an app to Tallyfy from Settings then Connections, so Tallyfy AI can work in that app as…
Get in touch
About Tallyfy