Every cloud Tally setup has exactly one question that decides its safety: how do people get in? There are three common doors. One is private but heavy, one is light but must be guarded, and one is simply an invitation to attackers.
When the video introduces the cloud plan, it names the honest alternative first: a VPN. Then it chooses TSplus because users should not need Tally installed on their own machines. A third door — plain RDP opened to the internet — is the one many cheap setups quietly use. This page compares all three doors the way an auditor would, so you can choose with open eyes.
Publishing the Windows Remote Desktop port 3389 on the internet is the single most dangerous way to run Tally on cloud. Automated scanners sweep the internet continuously looking for exactly this port, and once found, the server faces non-stop password-guessing (brute force) and every known RDP exploit. A large share of ransomware incidents in small businesses begin exactly here.
There is no version of "we set a good password" that makes this door acceptable. If your current provider has set Tally up this way, that is the thing to fix first — before features, before speed, before anything.
A VPN makes the server invisible: from the internet, there is no login page to attack at all. Only devices joined to your VPN can even see the server, and then they use it like a LAN machine.
The costs are real, and the video names the main one: in the classic VPN pattern, each user still needs Tally on their own computer, because the VPN only joins networks — it does not publish applications. You also manage VPN accounts and software on every staff device. For a small, fixed team with IT help, this is the most conservative door. For staff joining from many devices and homes, it is the heaviest to run.
TSplus publishes Tally through a web portal on HTTPS: the user opens a browser, signs in, and gets Tally — nothing installed, no data on their machine. This is the door the video builds, and it is a legitimate, widely used design.
Its honest weakness: the door is visible. Anyone can load the login page, so the page itself must be hardened — SSL certificate with HTTPS forced, TLS 1.2/1.3 only, strong unique passwords, 2FA enabled, brute-force protection (TSplus Advanced Security), and TSplus kept updated. A hardened portal is a reasonable door; the same portal left on defaults with a shared password is the RDP mistake in a nicer jacket.
3389, your accounts are being password-guessed tonight. If it is an HTTPS portal, ask the follow-up: "Is 2FA on?"The video installs TSplus, configures its ports and publishes Tally — watch it with this comparison in mind and the door choices become obvious.
▶️ Watch Full VideoYes — assume any internet-facing login page will be found and tested by automated bots. That is normal and manageable: forced HTTPS, strong unique passwords, 2FA and brute-force protection are designed for exactly this. What you must never expose is the raw RDP port 3389.
A VPN adds a small overhead, but for Tally data entry it is rarely the bottleneck — home internet quality matters more. The bigger VPN cost is management: software and accounts on every device, and Tally installed on each user machine in the classic pattern.
Yes, and cautious setups do: TSplus published only inside the VPN, so users connect the VPN first and then open the portal. You get the light app-publishing experience with the invisible-server privacy, at the cost of running both.