Skip to content

Security and data

Xero access is read only

Clarity asks Xero only for read access. It cannot create, change or delete anything in your books, and every refresh checks that the access Xero granted is read only before it runs. These are the permissions it asks for, and why:

  • accounting.transactions.read: invoices, bills, payments, bank transactions, credit notes, manual journals
  • accounting.contacts.read: customers and suppliers, for debtor and creditor figures
  • accounting.reports.read: profit and loss, balance sheet and trial balance, which the figures are checked against
  • accounting.settings.read: chart of accounts, tax rates, currencies and tracking categories
  • accounting.journals.read: the general ledger, for the monthly balance sheet and cash bridge
  • assets.read: the fixed asset register
  • offline_access: so the monthly refresh can run without asking you to sign in each time

Connecting and disconnecting

The connection is made on connect.claritybriefing.com: you sign in to Xero, choose your organisation, and we link it to your dashboard. Your dashboard links to a page that shows the organisation, whether the connection is live, when the data last refreshed and, if a refresh failed, Xero's own message. The same page has a button to reconnect and a button to disconnect. Disconnecting removes the connection in Xero straight away and stops any new data coming in; what is already on your dashboard stays until you reconnect, or until you leave and we delete it. You can also disconnect from Xero itself.

The keys that let Clarity read from Xero are encrypted (AES-256-GCM) in one separate store, used only by the connection service and the monthly refresh, and never sent to a browser.

Where your data lives

Each client has their own database and their own dashboard server, hosted in Frankfurt (EU). Your data is not pooled with anyone else's. Data travels encrypted, and is stored on the hosting provider's encrypted disks.

Who can sign in

Only the people you name can see your dashboard. They sign in with a one-time code sent to their email address.

The numbers, and where AI fits

Every figure on the dashboard is a fixed calculation on your data; no AI is involved in producing it. Revenue is reconciled month by month against Xero's own profit and loss report, and profit is taken from Xero's report directly.

If you choose, you can connect your own Claude account to your figures and ask questions about them. Claude reaches them through a connection on your dashboard, signed in as you, and nothing it does can reach Xero. It can be wrong, as any AI can; the dashboard remains the reference. We never use your data to train AI models.

When you leave

We disconnect Xero at once and delete your data (database, stored copies and dashboard) within 30 days. Before that, you can have a full export of your data in a standard format.

The providers we use

  • Render: Hosting of each dashboard and database (Frankfurt, EU)
  • Cloudflare: Storage of the raw copy of each refresh (EU)
  • GitHub: Runs the monthly refresh jobs
  • Auth0: Sign-in
  • Resend: Sends the sign-in codes by email
  • Anthropic: AI assistance (Claude) in our own work, under its commercial terms

Under POPIA you are the responsible party for your data and we process it on your behalf. Our privacy notice has the detail.

What we do not have yet

There is no SOC 2 report, no ISO 27001 certification and no independent penetration test at present.