Security and access control
What tlly does with your data and keys, and the controls the Business plan adds for companies.
Access
- Single sign-on. Business workspaces can sign in through your identity provider over OpenID Connect: Okta, Microsoft Entra, Google Workspace, Auth0 and others.
- Workspaces and roles. Owners, editors and viewers per workspace; viewers can't change dashboards, jobs or keys.
- Private dashboards. Any dashboard can be limited to signed-in members; shared links and embeds then stop working for everyone else.
- Audit log. Every change, by a person or an AI agent, is logged with who, what, when and from which IP, kept for a year and downloadable as CSV.
Your keys and data
- Narrow keys. Every integration guide shows the narrowest key the service offers. Pipedrive and Zendesk tokens can't be limited to reading, so their guides use a read-only user. Plausible and PostHog aren't read with a stored key.
- Encrypted at rest. Stored API keys are encrypted and only ever sent to the host they were saved for.
- Only numbers. tlly stores dated numbers and short labels, not your documents, customers or personal data.
- Separated workspaces. Each workspace's data lives in its own database, backed up nightly by the deploy (03:17 UTC).
Questions for your security review?
We'll answer questionnaires and walk your team through it.