FAQ
Frequently Asked Questions
Your data
Where is my data stored?
In a PostgreSQL database on Render, hosted in Frankfurt (Germany, EU). Each client gets a completely isolated database and web server — your data is never mixed with another client's. EU hosting provides adequate data protection under South African cross-border transfer requirements.
Who owns the infrastructure?
Two options depending on your compliance posture. For most clients, we host on their behalf — dedicated, isolated infrastructure that we manage for convenience. For clients with higher regulatory requirements, you own the Render account directly from day one. Both use the same architecture. The only difference is whose name is on the hosting account, and you can move from managed to self-owned at any time.
Can I take it with me if the engagement ends?
Yes. All code, documentation, and deliverables belong to you. The database is standard PostgreSQL. The dashboard is built on open-source tools (Evidence, Python, SQL). Any developer with common skills can maintain and extend it. There is no proprietary runtime, no compiled binary, and no vendor lock-in. If you are on managed hosting, we transfer the Render account to you. If you already own the account, you simply revoke our developer access.
Is the connection to my accounting system read-only?
Yes. The Xero integration uses read-only OAuth2 scopes. We pull data from Xero — we never write, modify, or delete anything in your Xero account. You can revoke access at any time from your Xero settings. The same principle applies to all other data sources (SimplePay, Toggl, portfolio platforms): read-only, revocable.
What data do you pull from Xero?
Invoices, bills, payments, contacts, journal entries, credit notes, bank transactions, the chart of accounts, and the P&L and balance sheet reports. All data is stored as-is in raw tables, then cleaned and typed in a canonical layer. The raw data is never modified — if something looks wrong, the original is always available for comparison.
What happens if I revoke access?
The dashboard continues to work with the data it already has. No new data will be synced. You can reconnect at any time and the sync picks up where it left off. Revoking access does not delete any data from your database.
AI and accuracy
Are the dashboard numbers AI-generated?
No. Every chart, table, and metric on the dashboard is a SQL query running against your PostgreSQL database. The numbers are deterministic — the same query produces the same result every time. AI is not involved in computing, displaying, or storing any figure on the dashboard.
What does the AI actually do?
AI enters the system in one place: when you connect Claude to your data via MCP (Model Context Protocol). Claude can then query the database to answer ad hoc questions, run pre-built workflows (meeting prep, pricing review, budget forecasting), and analyse patterns across your data. The dashboard is the daily operating tool. Claude is the analytical layer for questions the dashboard does not anticipate.
What if Claude gets something wrong?
Claude can be wrong. It is a language model, not a calculator. The architecture limits the blast radius in three ways. First, Claude cannot modify your data — MCP access is read-only. Second, every number Claude cites comes from a SQL query you can inspect and re-run. Third, the dashboard provides the verified baseline — if Claude's analysis contradicts what the dashboard shows, the dashboard is the source of truth. Claude is a reasoning tool, not an authority.
Are you locked into a specific AI model?
No. The MCP architecture is model-agnostic by design. The data layer and MCP server work with any AI that supports the protocol. We use Claude because it is currently the strongest model for analytical reasoning, but if a better option emerges — or if Anthropic's pricing changes — the system works with any compatible model. No retraining, no migration, no rebuild.
Does the AI improve over time?
Yes, automatically. The system uses Anthropic's production API. When Anthropic publishes a more capable model, every client gets the improvement immediately. There is no custom model to retrain, no fine-tuning to maintain, and no ML infrastructure to manage. The billions of dollars Anthropic invests in R&D flow directly to your workflows without any action on your part. This is the opposite of building custom AI infrastructure, which begins to decay the day you deploy it.
Is AI used to make decisions on my behalf?
No. Claude analyses and recommends. It does not execute transactions, send emails, modify records, or take any action. Every workflow produces output for a human to review. The system is designed as a decision-support tool, not an autonomous agent.
Privacy and compliance
Is my data sent to AI providers?
Only when you actively use Claude via MCP. The dashboard itself never sends data to any AI provider — it is a static web application querying a local parquet cache. When you connect Claude, queries go through the MCP server, which controls exactly what data Claude can access.
Does Anthropic use my data for training?
No. Under Anthropic's commercial terms (Claude Teams / API), client data is not used for model training. Data is retained for up to 30 days for trust and safety purposes, then deleted. A Data Processing Addendum is available from Anthropic for additional contractual assurance.
How is personally identifiable information handled?
For clients in regulated industries, the MCP server includes a PII tokenisation layer. Client names, account numbers, and identifiers are replaced with anonymous tokens before any data reaches Claude. Claude reasons over [CLIENT_047], not over a real name. De-tokenisation happens server-side, within infrastructure you control. For non-regulated clients, tokenisation is available but optional.
Where is the infrastructure hosted?
Frankfurt, Germany (EU). Render provides the hosting platform. Each client has isolated compute and database resources. No data is stored outside the EU unless you explicitly request a different region.
What about POPIA, FSCA, and cross-border data transfers?
EU hosting provides adequate protection under South African cross-border transfer rules. There is currently no FSCA prohibition on AI in financial services operations. The architecture is designed for transparency and auditability: every output is traceable to source data, full methodology documentation is published on the dashboard, and audit logging is available. A detailed compliance posture document covering POPIA, FSCA guidance, and data residency is available on request.
How it works
What is MCP?
Model Context Protocol — an open standard that gives AI models structured, secure access to a database. It replaces the custom orchestration APIs, model routers, and middleware that organisations would otherwise need to build. The MCP server is the only component that sits between Claude and your data. It controls access, enforces read-only permissions, and (where required) tokenises PII.
What are workflow templates?
Pre-built sets of instructions stored in the database that tell Claude how to execute a multi-step analysis. For example, a "Client Review Prep" workflow instructs Claude to pull revenue trends, check margins, review outstanding invoices, and flag unbilled work — then synthesise it into a meeting brief. The templates are plain text, not code. They reference specific database tables and describe what to look for, and Claude executes each step by querying your data.
Can I create or modify workflows myself?
Yes. Workflow templates are rows in a database table. You can edit existing templates, add new ones, or remove them — no code deployment required. The same mechanism that powers a meeting brief can drive a compliance checklist, a board pack, or a pricing review. Each new workflow is a set of instructions pointing at the same data.
What is the difference between the dashboard and Claude?
The dashboard is a web application — charts, tables, and traffic-light indicators rendered from live data. It shows you what you should be looking at. It requires no AI interaction and is accessible to all staff via a URL. Claude, connected via MCP, answers the questions the dashboard does not anticipate. It is the analytical layer for power users who want to interrogate the data conversationally. Not everyone needs Claude. The dashboard alone handles most daily operations.
What happens if Claude is unavailable?
The dashboard continues to work. It is a static web application with no AI dependency. All charts, metrics, and alerts function exactly as they do today. You lose the ability to run MCP workflows and ask ad hoc questions until Claude comes back online. The data layer is unaffected.
What tools is this built on?
PostgreSQL (database), Python (data pipeline), SQL (transforms and metrics), Evidence (open-source dashboard framework), and MCP (open standard for AI-data connection). No proprietary runtime, no compiled binaries. Any developer with standard skills can read, maintain, and extend the system. Source code escrow is available if required.
Data quality and freshness
How often does the data update?
By default, data refreshes when your accountant confirms the books are closed for the month, or on a fallback schedule (typically every 10 days). Each refresh pulls the latest data from Xero and rebuilds all metrics. The dashboard always shows when it was last updated.
What if my books are not closed for the month?
The system automatically excludes the current month and the previous month from all metrics. This prevents partial data from distorting the picture — a month with expenses booked but no revenue would make the business look like it is in crisis. When your accountant confirms a month is closed, we release it for display. This is a one-line configuration change, not a code deployment.
How do I verify the numbers match my own records?
The Trust Dashboard (under Methodology) shows data freshness, record counts, and sync status for every data source. For financial metrics, we reconcile against your management accounts during onboarding and flag any discrepancy above a configurable tolerance (default: 2%). The reconciliation is documented and repeatable. If a number looks wrong, every metric can be traced back through the SQL to the raw Xero data.
How do you handle multi-currency?
All monetary amounts are stored in their original currency alongside the Xero spot rate at the time of the transaction. Aggregation always uses converted amounts (reporting currency) — never raw amounts across currencies. For single-currency organisations, this is invisible. For multi-currency organisations, it is built into the data model from day one.
What are the known limitations?
They are documented transparently on the Limitations page. Common ones: the Xero P&L report API covers trailing 12 months only (we use journal lines for longer history), tracking categories may be incomplete, and invoice-based revenue can differ from accrual-based P&L revenue due to timing. Every known limitation is listed, explained, and where possible, worked around.
Getting started
What do I need to provide?
A read-only connection to your Xero account (OAuth2 — you authorise access through Xero's own login flow). If you have time tracking (Toggl, Harvest) or payroll (SimplePay) data, API keys for those. No data exports, no spreadsheets, no IT involvement. The entire onboarding runs from API connections.
How long does onboarding take?
Four weeks from data access to a live dashboard with findings and workflow templates. The first week is data ingestion and validation. Weeks two and three are analysis and dashboard build. Week four is review, reconciliation, and onboarding session. The system runs alongside your existing tools — there is no cutover event.
Does this replace my existing tools?
No. The dashboard runs alongside whatever you use today — Xero, Excel, Power BI, manual processes. Over time, as data coverage expands, your team decides which tool serves which purpose. Some clients retire their spreadsheets within a month. Others run both indefinitely. There is no pressure either way.
What ongoing support is included?
An optional monthly retainer covers new data source integrations, dashboard updates, and keeping pace with Anthropic's evolving capabilities. The system runs independently without the retainer — it is not required for continued operation. It adds value by expanding coverage and refining the analysis as your business evolves.
What if I need something that is not built yet?
New metrics are SQL views — typically a few hours of work. New dashboard pages are markdown files. New workflows are database rows. The architecture is designed so that extending the system is configuration, not engineering. Most client requests are fulfilled within the current monthly cycle.