How we look after your data

1. Read-only access to Xero

When you connect, Billflation asks Xero for these permissions and nothing else:

• View invoices (accounting.invoices.read): your bills and credit notes.
• View contacts (accounting.contacts.read): the names of the suppliers on those bills.
• View organisation settings (accounting.settings.read): your organisation's name and currency.
• Your name and email from Xero's sign-in, and permission to stay connected so the paid plan can check new bills.

Each of these only allows reading. Billflation can't create, change or delete anything in your Xero file, and it never asks for access to bank accounts, payroll or payments.

2. Encryption

• Everything between your browser, Billflation and Xero travels over HTTPS.
• Our database is encrypted at rest.
• Your Xero connection tokens are encrypted again (AES-256-GCM) with a separate key, and are never written to logs.

3. Kept in Australia

Billflation runs on Microsoft Azure in Sydney, and your bills and results are stored there.

4. One customer can't see another

Every request is tied to the organisation in your own signed-in session, never to anything sent from the browser, so one customer can't reach another customer's data. On the free plan, rows you haven't unlocked are counted on our servers and never sent to your browser.

5. No AI on your bills

Billflation matches items using fixed rules you can check, not an AI model. Your bills are never sent to an AI provider, and Xero's terms don't allow its data to be used to train AI models.

6. Only what's needed, only as long as needed

Billflation reads 25 months of supplier bills and nothing else. Raw data from Xero is kept for up to 90 days. Disconnecting deletes your bill data straight away, and "Delete all my data" removes everything. The details are in our privacy policy.

7. Found a problem?

If you think you've found a security issue, please email [email protected] with "Security" in the subject and the details. We'll reply quickly and keep you updated. Please don't access other people's data or disrupt the service while testing.