Tallymeter

Security Policy

Last updated: July 14, 2026

Overview

Tallymeter is operated by MB Nexus Consulting (Lithuania, EU). This page describes the technical and organizational measures we use to protect your data. Questions or concerns: [email protected].

Encryption

  • In transit — all traffic to tallymeter.com is encrypted with TLS. Plain-HTTP requests are redirected to HTTPS.
  • At rest — sensitive fields (bank details, Jira API tokens) are encrypted at the application layer before they reach the database. Passwords are stored only as bcrypt hashes. API tokens and OAuth refresh tokens are stored only as hashes.
  • Card data — payment details go directly to Stripe; card numbers never touch our servers.

Access control

  • Every record is scoped to your account and workspace. Tenant isolation is enforced in the application layer and covered by automated tests that run on every deploy.
  • API access uses scoped tokens — each token carries only the abilities it was granted (for example, a timer token cannot read reports).
  • Third-party integrations (such as the Tallymeter for Jira app) connect through OAuth 2.0 with PKCE, short-lived access tokens and rotating, single-use refresh tokens. You can revoke any connection at any time from Settings → API tokens.
  • Production access is limited to authorized personnel over SSH with key-based authentication; password login is disabled.

Infrastructure

  • Application and database servers are hosted by Hetzner Online GmbH in Germany (EU).
  • Traffic is proxied through Cloudflare, which provides TLS termination at the edge and DDoS protection.
  • Databases are backed up regularly; backups remain within the EU.
  • Operating systems and dependencies are kept up to date; the application is deployed with a zero-downtime process so security fixes ship without maintenance windows.

Development practices

  • Every change runs through an automated test suite (including tenant-isolation tests) before it can be deployed.
  • Deploys are gated on continuous integration; a failing pipeline blocks the release.
  • Errors in production are monitored (Sentry) and investigated as they occur.
  • No production data is used in development or testing environments.

The Jira app

The Tallymeter for Jira app runs entirely on Atlassian Forge. It stores no Atlassian credentials — each Jira user individually authorizes the connection through an OAuth consent screen, and the resulting tokens are held by Atlassian's Forge platform, not by us. The app exchanges only the issue key and issue summary with tallymeter.com, and access can be revoked at any time from Atlassian's Connected Apps screen or from Tallymeter → Settings → API tokens.

Incident response

If we become aware of a breach affecting personal data, we will notify affected customers without undue delay and, where required, the supervisory authority within 72 hours, in line with the GDPR and our Data Processing Addendum.

Reporting a vulnerability

If you believe you have found a security vulnerability in Tallymeter, please email [email protected] with the details. We ask that you give us a reasonable opportunity to investigate and fix the issue before any public disclosure. We will acknowledge your report promptly, keep you informed of progress, and credit you if you wish. We do not pursue legal action against good-faith research conducted within these guidelines.