The Three-Layer Framework for Cloud Data Protection
Data protection for a cloud-hosted business application (Tally, Busy, ERP, or any Windows application) operates across three independent layers. Each layer addresses different threat scenarios. Together, they provide comprehensive protection that addresses the realistic threats Indian businesses face.
- Layer 1 — Encryption: Makes data unreadable to anyone who accesses it without authorisation
- Layer 2 — Access control: Restricts who can reach the server in the first place
- Layer 3 — Backup: Ensures recovery when something goes wrong — regardless of cause
Layer 1: Encryption — Data Unreadable Without Keys
Data in Transit
All communication between your device and the cloud server travels over TLS-encrypted Remote Desktop connections. Without the encryption key (negotiated during session establishment), intercepted network traffic is meaningless — screen images, keystrokes, and application data are encrypted.
Data at Rest
M A Global Network hosted servers use encrypted storage for backup data. Primary server storage can be encrypted at the OS level using Windows BitLocker — available on request for environments with specific data sovereignty or compliance requirements.
Data on End-User Devices
The most effective data encryption for end-user devices: ensure no data is stored on them. When Tally or Busy runs on a cloud server accessed via RDP, no database files exist on staff laptops. A lost or stolen device exposes no business financial data — there is none on the device to expose.
Layer 2: Access Control — Who Can Reach Your Server
| Access Control | What It Restricts | How Configured |
|---|---|---|
| IP-whitelisting firewall | Connections from unknown IP addresses | Network firewall — blocks before reaching Windows |
| Windows user accounts | Who can log into a Windows session | Individual accounts per staff member |
| Network Level Authentication (NLA) | Unauthenticated connection attempts | Windows RDP configuration — authentication before session |
| Account lockout policy | Brute-force password guessing | Windows Group Policy — 5 attempts → lockout |
| Tally company passwords | Who can open specific Tally companies | Within Tally — independent of Windows access |
| Tally user access levels | Which vouchers and reports users can access | Within Tally security configuration |
Layer 3: Backup — Recovery When Something Goes Wrong
Backup is the last line of defence — when all other controls fail or when events outside any control (hardware failure, accidental deletion) cause data loss. The specific backup configuration M A Global Network provides on all plans:
- Daily automated backups scheduled after business hours
- Off-site storage — geographically and network-separate from primary server
- 7-day retention — point-in-time recovery for any day in the past month
- Monitored completion — failures alert the M A Global Network team immediately
- Tested restoration — periodic verification that backups restore correctly
DPDPA 2023 — Practical Implications for Indian Businesses
India's Digital Personal Data Protection Act 2023 creates obligations around personal data handling. For businesses using Tally or Busy for payroll — which processes employee personal data — and for CA firms managing client PAN, Aadhaar references, and financial records, cloud infrastructure with documented controls provides a stronger compliance baseline than most local server setups.
Relevant controls from a DPDPA perspective: documented access control (who can access what data and when), encryption of data in transit, backup and recovery procedures, and data localisation (Indian data centres ensure data does not leave Indian jurisdiction). M A Global Network's managed service provides all four. Consult your legal adviser for firm-specific DPDPA compliance guidance.
Practical Steps After Migration to Cloud
- Enable Tally company-level security — set a company password and configure user access levels within Tally
- Confirm IP whitelist is complete — verify all staff home IPs and branch office IPs are in the firewall rules
- Create individual Windows accounts — no shared logins; each staff member has their own credentials
- Verify first backup completed — check with M A Global Network that the first daily backup ran successfully
- Establish offboarding procedure — document the process for disabling Windows access when a staff member leaves
Frequently Asked Questions
Yes. M A Global Network hosts data in professionally managed Indian data centres. Data stored on these servers is subject to Indian law — not the laws of other jurisdictions. This is relevant for DPDPA compliance (Indian data protection law applies), for businesses subject to RBI or SEBI data localisation requirements, and for general data sovereignty preferences. Your financial data, employee data, and business records never leave Indian jurisdiction.
Contact M A Global Network's support team immediately by phone — 24/7 availability. Do not attempt to investigate or remediate on your own as this can destroy forensic evidence. Our team will isolate the affected server if needed, assess the extent of any compromise, initiate restoration from the most recent clean backup, and identify and close the entry point. Incident response is included in the managed service — no additional charges.
Three Layers of Data Protection — Built Into Every Plan
Encryption · Access control · Daily backups. ₹700/user/month + 18% GST yearly. 7-day risk-free guarantee.