Built to protect your money data

Isolation enforced by the database

Every Talisk account's data (mail, contacts, books, documents) lives in its own isolated database schema. Your mail, contacts, books and documents are never in the same tables as another customer's.

Inside your account, PostgreSQL Row-Level Security adds a second boundary that the database engine enforces itself. When you invite a bookkeeper and limit them to one set of books or one mailbox, that limit is a database rule, not a filter the app is trusted to remember. It fails closed: a query that arrives without the scope set returns nothing at all, rather than everything.

Encrypted, in transit and at rest

• ✓ In transit: every connection to Talisk uses TLS (HTTPS).
• ✓ At rest: personal content (email bodies, contact details, financial documents) is encrypted with a per-account key (Fernet, AES-based). Uploaded files like receipts and attachments are encrypted at rest too.
• ✓ Credentials: passwords are stored only as salted hashes; OAuth tokens for connected services are encrypted at rest.

Backups you could actually recover from

Nightly database backups are GPG public-key encrypted before they leave the server and stored off-site. The decryption key isn't stored alongside them. A copy of the backup bucket on its own reveals nothing.

A restore is verified every day against the encrypted backup, so "we have backups" is something we prove, not just claim.

Guardrails against catastrophic mistakes

The database carries engine-level triggers that refuse to drop or bulk-delete customer data, and they apply to every database role, including the superuser. Getting past them takes a deliberate, single-transaction override that expires the moment it is used.

This exists because the failure it prevents is real: a mistyped command at the wrong moment should not be able to erase a business's records. Defence in depth, aimed at us as much as anyone else.

Recovery down to the minute

Beyond the nightly dump, the database ships a continuous encrypted write-ahead log off-site, plus a weekly full base backup. That is what makes point-in-time recovery possible: not just "restore last night", but restore to just before whatever went wrong.

Those archives are encrypted with the same key pair as the nightly backup, so no readable copy of your data leaves the server by any route.

Getting into your account

You can turn on two-factor authentication, and Talisk emails you when a new device signs in. Connecting a mailbox uses the provider's own OAuth consent, so we never see or store your email password.

Who else can see your data

A short, boring list, and no advertising or analytics companies on it. We use Anthropic for the AI that drafts replies and reads bills, under terms that forbid training on your content; Stripe for payments, so card numbers never touch our servers; and DigitalOcean for hosting and encrypted backup storage. Your mail provider is whoever you connected, on your own OAuth grant.

Your data is yours, never shared

We don't sell or share your data, and we never train public AI models on it. The AI that drafts your replies and reads your bills works on your behalf, on your data, for you.

You can export your books and documents whenever you want, and ask us to delete your account and its data. After a deletion request we hold it for 30 days in case it was a mistake, then remove it.