OUTBOUND ONLY
Node initiates connections
SECURITY BY ARCHITECTURE
Secure access to Tally—without exposing Tally.
Tally and Prism Node stay inside your environment. Node initiates encrypted outbound communication with Prism Cloud, so no inbound firewall rule or publicly exposed Tally port is required.
- CUSTOMER ENVIRONMENT
- TALLY
- PRISM NODE
- OUTBOUND ENCRYPTED
- PRISM CLOUD
Prism security at a glance
NO INBOUND PORT
Tally stays behind the firewall
ENCRYPTED IN TRANSIT
HTTPS internet traffic
SERVER-SIDE CONTROL
Access checked centrally
SEPARATED DATA
Customer boundaries enforced
DATA BOUNDARY
See exactly what stays, what moves and what returns.
Prism extends Tally through a controlled working copy of relevant operational data—not by opening Tally to the internet.
STAYS IN YOUR ENVIRONMENT
Tally company data and Prism Node
MOVES TO PRISM CLOUD
Relevant operational data
CREATED IN PRISM
Workflow states, approvals and operational records
RETURNS THROUGH NODE
Approved transactions, status and references
STAYS IN YOUR ENVIRONMENT
Tally company data and Prism Node
MOVES TO PRISM CLOUD
Relevant operational data
CREATED IN PRISM
Workflow states, approvals and operational records
RETURNS THROUGH NODE
Approved transactions, status and references
Tally remains the system of record.
ACCESS ENFORCEMENT
Every request passes three checks.
Signing in is only the start. Prism verifies the user, authorises the requested action and applies the correct customer, company and warehouse scope before data is returned.
AUTHENTICATE
Is the user signed in?
AUTHORISE
Can this action be performed?
APPLY SCOPE
Which records apply?
RETURN RESULT
Allowed data only
POLICY DECISION
ALLOWEDRequest continues
DENIEDDenied by default
AUTHENTICATE
Is the user signed in?
AUTHORISE
Can this action be performed?
APPLY SCOPE
Which records apply?
POLICY DECISION
RETURN RESULT
Allowed data only
ALLOWEDRequest continuesDENIEDDenied by default
OPERATIONAL FOUNDATIONS
Security is integral to every connection and action.
Prism protects credentials and traffic, separates environments and data scope, and governs production change with traceable operational evidence.
PROTECT
MANAGED SECRETS
Credentials kept out of application code.
ENCRYPTED TRAFFIC
Internet communications use HTTPS.
ISOLATE
SEPARATED ENVIRONMENTS
DEV, QA and LIVE remain isolated.
SCOPED DATA ACCESS
Customer, company and warehouse boundaries are enforced.
GOVERN & EVIDENCE
CONTROLLED RELEASES
Production change follows controlled promotion.
STRUCTURED LOGGING
Events and references support investigation.
CONNECTIVITY RESILIENCE
Temporary interruption does not mean lost or duplicated work.
When a connection is interrupted, Prism queues pending exchanges, retries in a controlled sequence and checks for duplicate submissions before confirmation.
QUEUED
Exchange queued locally
RETRYING
Retry in controlled sequence
DUPLICATE CHECK
Check for duplicate submission
SUBMITTED
Send to Prism successfully
CONFIRMED
Exchange confirmed
DUPLICATE BLOCKEDNot submitted
QUEUED
Exchange queued locally
RETRYING
Retry in controlled sequence
DUPLICATE CHECK
Check for duplicate submission
SUBMITTED
Send to Prism successfully
CONFIRMED
Exchange confirmed
Scoped to temporary connectivity interruption—not backup or disaster recovery.
SHARED RESPONSIBILITY
Security works when the boundary is clear.
Prism protects the cloud service and controlled exchange. You remain in control of the environment, accounts and devices around Tally.
PRISM PROTECTS
- Cloud application and managed services
- Server-side access enforcement
- Customer, company and warehouse data scope
- Node-to-cloud exchange protocol
- Managed application secrets
- Cloud logging and release controls
CONTROLLED EXCHANGE
YOU CONTROL
- Tally configuration and authorised users
- Prism Node host, network and physical access
- User onboarding and removal
- Passwords and device security
- Local Tally backup and recovery
- Endpoint and firewall management
CLOUD LOCATION
Prism application services run in Google Cloud europe-west1.
PRACTICAL QUESTIONS
Straight answers to the questions buyers ask.
Clear architecture deserves clear explanations.
No. Tally and Prism Node stay within the customer environment. Prism Node initiates encrypted outbound communication with Prism Cloud; Prism Cloud does not initiate an inbound connection to Tally.
Relevant operational data needed by the enabled Prism workflows is synchronised to Prism Cloud as a controlled working copy. Prism also holds Prism-native workflow states, approvals and operational records. Tally remains the system of record for the Tally data it holds.
No inbound firewall rule or publicly exposed Tally port is required for Prism Cloud. Prism Node initiates the outbound exchange using HTTPS. Your local network and endpoint controls remain under your control.
Prism checks that the user is signed in, verifies that the requested action is authorised and applies the relevant customer, company and warehouse scope before returning data.
Data scope is enforced server-side. Each request is limited to the customer, company and warehouse context that applies to the authorised action.
Prism Node can queue pending exchanges, retry them in a controlled sequence and check for duplicate submissions before confirmation. This is connectivity resilience; it is not a backup or disaster-recovery commitment.
Prism application services run in Google Cloud's europe-west1 region.
You remain responsible for Tally configuration, authorised users, the Prism Node host and network, physical access, user onboarding and removal, passwords, devices, local Tally backup and recovery, endpoints and firewall management.
EXTEND TALLY WITH CONFIDENCE
Protect the system you rely on. Extend it with confidence.
Prism creates a controlled route from Tally to the operational workflows your teams need—without exposing Tally to the internet.
Book a demo
- TALLY DATA
- PRISM NODE
- CONTROLLED OUTBOUND PATH
- PRISM OPERATIONAL WORKFLOWS