Security and Privacy — UppaGo Help

Audit trail

Every action — extraction, approval, correction, rejection, push, autonomy decision — is recorded immutably. You see this on:

The activity feed for any document (who did what, when).
The "Tally explains" footer on each document (why she decided what she decided).
The push history page (every QuickBooks push with timestamp + result).

If you're a bookkeeper, the audit trail tracks which team member took which action, so a firm always has accountability for client work.

Bookkeeper vs client visibility

When a bookkeeper is assigned to a client, what they see depends on the access level:

View — read-only. Documents, notes, history. Can't change anything.
Review — review-level. Can approve / correct / reject documents and manage day-to-day operations, and can open a QuickBooks push preview — but committing the push requires full access.
Full — full operational access plus client-workspace settings, GL mappings, and assigning other team members.

The client is always the Portal Owner of their own workspace. The Portal Owner decides who has access. If a Portal Owner revokes a bookkeeper's access, that bookkeeper can no longer see the client's data — even if they previously did.

Common issues

"A team member at my firm shouldn't have access to a client they're seeing." Check the assignment — Settings → Team → that team member → Assignments. Remove the assignment if it's wrong.
"A bookkeeper had access to my business and I want to revoke it." As the Portal Owner, open Settings → Access → revoke the bookkeeper's grant. They lose access immediately.
"My client's data showed up in another client's view." This shouldn't happen. If you ever see it, contact [email protected] immediately with the specifics — it would be a real bug.
"Tally auto-approved something I wouldn't have." Reject the document within the override window. The rejection is recorded against that vendor and counts against its approval rate; a run of recent reviews going against Tally caps the vendor until the pattern recovers. That cap is temporary and lifts as the pattern recovers. If you want automatic approval off for that vendor for good, pause or disable it in settings — that is the permanent switch.
"Can I get my data out of UppaGo?" Yes. Email [email protected] to request an export. CSV and JSON formats supported.

Connections — bank and QuickBooks

Bank connections flow through Plaid. Tally never sees your bank credentials. Plaid issues Tally a scoped, read-only token. You can disconnect at any time from your settings.
QuickBooks connections use Intuit's standard OAuth. You authorize Tally for a specific QuickBooks company; Tally never sees your Intuit password. You can revoke access from QuickBooks's own connection management at any time.

If you're a bookkeeper using a client's connections, the credentials live with the client. You're authorized to use them via your assignment, not because you have the keys.

Data retention

Documents and learned patterns persist as long as your account is active.
If you cancel, your data is preserved (downgraded workspaces stay readable; you can re-subscribe later).
Audit and event records are retained by design rather than trimmed on a published schedule. We do not publish a retention period, because the obligations that would set one have not been established (see the deletion section).
You can request a data export at any time by contacting support.

Human approval is the rule, not the exception

Tally's autonomy is earned, not assumed:

For every vendor, Tally starts at "Manual" — humans review every document.
Once a vendor has at least 3 live reviews at an 80% approval rate, Tally proposes values for you to confirm.
Automatic approval requires more: at least 5 live reviews, at least 10 in total, a 90% approval rate, and a document amount at or below $2,000. Those conditions make a vendor eligible — every document is still checked on its own.

A vendor never auto-approves until enough live human reviews have built the track record. Imports give Tally context, not authority. See How Tally learns for the details.

You can always override Tally:

Reject any auto-approved document within a window.
Reduce or pause autonomy for a vendor.
Disable autonomy entirely for a client.

What firms see in their Command Center

The Bookkeeper Command Center rolls up information across the firm's clients:

Counts and summaries (for example, how many clients are close-ready, or the firm-wide automation estimate).
KPI tiles for ROI and close readiness.
Top blockers (e.g., "12 clients have unmapped GL accounts").

These are aggregations. Drilling into a specific number takes the firm operator into a single client's workspace, where standard workspace-isolation applies. The Command Center never shows raw documents from one client visible to a team member who isn't assigned to that client.

What's next

For technical detail on encryption, audit, deletion, and third-party providers, see Data Security.
How Tally learns — boundaries explained more fully
Bookkeeper workspace — assignment and access-level mechanics
Plans and billing — which tier covers which boundary features
Troubleshooting

Other clients' data. Two clients in the same firm never see each other's anything.
Other firms' data. Patterns Tally learns inside one firm stay inside that firm. They never seed defaults for a different firm's clients.
Backend secrets. Tally never reveals implementation details, environment configuration, or other operational specifics — even when you ask. If you ask "what database do you use?" the answer is "we keep your data secure" not a technical breakdown.

What you'll do

Understand who can see what across firms, clients, and team members.
Know how Tally's autonomy interacts with your right to override.
See what's tracked in the audit trail.
Find the right help article when a privacy question is really a permissions question.

Workspace boundaries — what they mean

Every business in UppaGo has its own workspace. Documents, vendors, usual vendor patterns, learned history, and the entire memory layer for one workspace are scoped to that workspace.

Two SMBs using UppaGo independently never see each other's anything. Different accounts, different workspaces, full separation.
A firm managing multiple clients sees each client as a separate client workspace. The firm operator is the only person with cross-client visibility — and only for clients they're explicitly assigned to. Documents, vendors, and numbers from one client are never visible inside another client.
Firm memory (Business tier) is the one cross-client thing — but it's patterns, not raw data. "This firm consistently maps Adobe Creative Cloud → Software Subscriptions" can be a default for new clients. The actual Adobe invoices, amounts, and notes from one client are never visible inside another.