Most offices protect crores of accounting data with one shared Tally password - written on a diary, passed on chat, known by people who left last year. Here is what that password really does, and where its protection honestly ends.
When you enable Security Control in TallyPrime, opening the company asks for a user name and password. That feels like proper security, and it is a good first lock. But a lock is only as strong as who holds the key and how many copies exist. In most small offices the same password is shared by the accountant, the owner, the data entry operator and last year's intern. At that point the password still blocks strangers - it no longer proves anything about the person using it.
Company : ************ (name hidden by TallyVault)
User Name : Admin
Password : ••••••••
One shared password here means every login looks identical - whoever typed it.
With Security Control on (Alt+K → Control User Access to Company Data: Yes), a company will not open until a valid user name and password are entered. Each user carries a security level - Owner, Data Entry Operator, or a custom level you define - and that level decides what the person can see and do: enter vouchers, alter them, delete them, view the books, print reports. Used with separate users, this is real, useful protection inside Tally.
The failure is not in Tally; it is in the habit. When five people sign in as the same user:
Even a strong, private password has honest limits:
This is exactly the gap a second factor fills: a code generated on one specific person's phone.
Before adding any 2FA, clean up the inside. Keep Owner rights with the owner and at most one trusted senior. Give daily staff a level that matches their work - a data entry operator who can enter vouchers usually does not need the right to delete them or alter past entries. TallyPrime lets you define custom security levels, disallowing specific actions like backdated entries, alteration or printing. Fewer powers per person means a misused login can do less damage.
TallyPrime has a password policy under the company settings: minimum strength, password expiry and password history, and whether a user may change their own password. Turn it on. Honestly graded, though: a policy only helps when users are separate. Forcing a shared password to become longer and more complicated just makes people write it in bigger letters on the same diary.
Keep the Tally password - it is the first lock and it works. But treat it as one factor, not the whole security. Give every person their own Tally user, give the remote door a second factor as shown in the main guide, and the two layers together do what neither can do alone: the login starts to mean a specific person, not just a known secret.
The video adds the layer this page argues for - two step verification on the door your team uses to reach Tally.
▶️ Watch Full VideoNo. TallyVault is encryption with a password: it encrypts the company data and even hides the company name in the Select Company list (it shows as asterisks). That is one factor made stronger, not a second factor. And be careful - Tally does not offer a recovery for a lost TallyVault password, so the owner must store it safely.
Not really. A new shared password becomes shared again within a day, and frequent forced changes push people to write passwords down. Separate named users - where one person's password can be reset without touching anyone else - fix the actual problem.
Yes, and it costs nothing. Two named users take two minutes to create, and if one person is ever unavailable, the other still has their own clean access. The edit log also stays truthful about who entered what.