Security and Privacy — UppaGo Help

Audit trail

Every action — extraction, approval, correction, rejection, push, autonomy decision — is recorded immutably. You see this on:

The activity feed for any document (who did what, when).
The "Tally explains" footer on each document (why she decided what she decided).
The push history page (every QuickBooks push with timestamp + result).

If you're a bookkeeper, the audit trail tracks which team member took which action, so a firm always has accountability for client work.

Bookkeeper vs client visibility

When a bookkeeper is assigned to a client, what they see depends on the access level:

View — read-only. Documents, notes, history. Can't change anything.
Review — review-level. Can approve / correct / reject documents and manage day-to-day operations, and can open a QuickBooks push preview — but committing the push requires full access.
Full — full operational access plus client-workspace settings, GL mappings, and assigning other team members.

The client is always the Portal Owner of their own workspace. The Portal Owner decides who has access. If a Portal Owner revokes a bookkeeper's access, that bookkeeper can no longer see the client's data — even if they previously did.

Common issues

"A team member at my firm shouldn't have access to a client they're seeing." Check the assignment — Settings → Team → that team member → Assignments. Remove the assignment if it's wrong.
"A bookkeeper had access to my business and I want to revoke it." As the Portal Owner, open Settings → Access → revoke the bookkeeper's grant. They lose access immediately.
"My client's data showed up in another client's view." This shouldn't happen. If you ever see it, contact [email protected] immediately with the specifics — it would be a real bug.
"Tally auto-approved something I wouldn't have." Reject the document. The rejection is recorded against that vendor and counts against its approval rate; a run of recent reviews going against Tally caps the vendor until the pattern recovers. That cap is temporary and lifts as the pattern recovers. There is no setting that turns automatic approval off for one vendor permanently.
"Can I get my data out of UppaGo?" Yes. Email [email protected] to request an export. CSV and JSON formats supported.

Connections — bank and QuickBooks

Bank connections flow through Plaid. Tally never sees your bank credentials. Plaid issues Tally a scoped, read-only token. You can disconnect at any time from your settings.
QuickBooks connections use Intuit's standard OAuth. You authorize Tally for a specific QuickBooks company; Tally never sees your Intuit password. You can revoke access from QuickBooks's own connection management at any time.

If you're a bookkeeper using a client's connections, the credentials live with the client. You're authorized to use them via your assignment, not because you have the keys.

Data retention

Documents and learned patterns persist as long as your account is active. Uploaded documents are kept for at least seven years from the end of the calendar year you uploaded them, for as long as your account exists.
If you cancel, your data is preserved (downgraded workspaces stay readable; you can re-subscribe later).
Audit and event records are retained by design rather than trimmed on a published schedule. We do not publish a retention period, because the obligations that would set one have not been established (see the deletion section).
You can request a data export at any time by contacting support.
After an account is deleted, backup and recovery copies can still hold its data for a period. A bounded removal schedule is being put in place, with no timeline stated yet.
Your account data and documents are stored in the United States. See Data Security for encryption, data location and the service providers that operate in their own locations.

Human approval is the rule, not the exception

Tally's autonomy is earned, not assumed (automatic approval is on Pro and above):

For every vendor, Tally starts at "Watching" — humans review every document.
Once a vendor has at least 3 live reviews at an 80% approval rate, Tally proposes values for you to confirm.
Automatic approval requires more: at least 5 live reviews, at least 10 in total, a 90% approval rate, and a document amount at or below $2,000. Those conditions make a vendor eligible — every document is still checked on its own.

A vendor never auto-approves until enough live human reviews have built the track record. Imports give Tally context, not authority. See How Tally learns for the details.

You can always override Tally:

Reject an auto-approved document. The rejection is recorded as an override of Tally's decision.
Reject or correct a vendor's documents. Each rejection counts against that vendor's approval rate, and a recent run of reviews that went against Tally stops automatic approval for that vendor until the pattern recovers. Rejecting a document flagged as a possible duplicate resolves the copy: it is not counted in the vendor's approval rate, review count or stage.

There is no setting to pause or switch off autonomy for a vendor or a client yourself.

What firms see in their Command Center

The Bookkeeper Command Center rolls up information across the firm's clients:

Counts and summaries (for example, how many clients are close-ready, or the firm-wide automation estimate).
KPI tiles for ROI and close readiness.
Top blockers (e.g., "12 clients have unmapped GL accounts").

These are aggregations. Drilling into a specific number takes the firm operator into a single client's workspace, where standard workspace-isolation applies. The Command Center never shows raw documents from one client visible to a team member who isn't assigned to that client.

What's next

For technical detail on encryption, audit, deletion, and third-party providers, see Data Security.
How Tally learns — boundaries explained more fully
Bookkeeper workspace — assignment and access-level mechanics
Plans and billing — which tier covers which boundary features
Troubleshooting

Other clients' data. Two clients in the same firm never see each other's anything.
Other firms' data. No document, amount or note from one firm's clients is visible to another firm, and nothing crosses between firms: a bookkeeper's own firm memory stays inside each firm they work with, no one else sees it, and nothing seeds defaults for a different firm's clients.
Backend secrets. Tally never reveals implementation details, environment configuration, or other operational specifics — even when you ask. If you ask "what database do you use?" the answer is "we keep your data secure" not a technical breakdown.

What you'll do

Understand who can see what across firms, clients, and team members.
Know how Tally's autonomy interacts with your right to override.
See what's tracked in the audit trail.
Find the right help article when a privacy question is really a permissions question.

Workspace boundaries — what they mean

Every business in UppaGo has its own workspace. Documents, vendors, usual vendor patterns, learned history, and the entire memory layer for one workspace are scoped to that workspace.

Two SMBs using UppaGo independently never see each other's anything. Different accounts, different workspaces, full separation.
A firm managing multiple clients sees each client as a separate client workspace. The firm operator is the only person with cross-client visibility — and only for clients they're explicitly assigned to. Documents, vendors, and numbers from one client are never visible inside another client.
Firm memory is the one cross-client thing — but it holds categories, not raw data, it is each bookkeeper's own record, and it stays inside one firm. When you approve an Adobe Creative Cloud invoice as Software Subscriptions, an Adobe invoice in another of that firm's client workspaces, including a new client's, shows you the category you most recently approved or corrected for it across that firm's client workspaces you work in or have worked in. A bookkeeper who works with more than one firm keeps a separate firm memory in each firm. The actual Adobe invoices, amounts, and notes from one client are never visible inside another.