Security & trust
What we lock, and what we don't claim.
XAIO holds your books, your payroll and your team's personal data. Below is exactly how we look after it, including the boundary we don't claim you can see straight through.
Invoices
Draft, sent, overdue, part-paid
40
Bills to pay
Green beans, freight, rent
30
Bank lines to reconcile
Last fortnight, left for you
18
Team on the roster
Casual, part-time and salaried
5
The demo business
Transactions are free. Configuration is frozen.
Every account includes Coastline Coffee Supply, a real practice tenant you can post real transactions against. What you can’t do is touch the setup: the chart of accounts, tax codes and integrations are locked, so a demo can never drift into something that looks like production, or reach a real bank, a real customer, or the ATO.
“Transactions are free. Configuration is frozen. Nothing leaves the building.”
Invoices
Draft, sent, overdue, part-paid
40
Bills to pay
Green beans, freight, rent
30
Bank lines to reconcile
Last fortnight, left for you
18
Team on the roster
Casual, part-time and salaried
5
Security posture
Designed in, not bolted on.
AU-data-resident
Your data lives in AWS Sydney (ap-southeast-2). It does not leave Australia for storage. AI features send the text you ask about to overseas inference providers (for example the United States), so AI processing is not Australia-only.
Encryption at rest & in transit
Encryption at rest (managed by our cloud provider) and application-level encryption of sensitive data such as TFNs. TLS encryption in transit on all customer-facing endpoints.
Optional TOTP 2FA
Optional two-factor authentication (TOTP) available on every account. Sessions are refreshed automatically and expire.
Tenant-scoped in the API
Every request is scoped to your tenant inside the API before it touches the database, books, payroll and roster filtered the same way, every time. That is application code we test, not a database-enforced wall: isolation is applied in the API, so we do not describe it as row-level security.
Pulse never trains on you
We use leading AI providers under their data-protection terms and do not use your data to train models.
Audit logging
Audit logging records who changed what and when across journals, invoices, payroll records and user settings.
Data lifecycle
Where your data is, every step of the way.
You upload it
Receipts, transactions, payroll. TLS encryption from your browser to our edge.
We store it
Encrypted at rest in the database and file storage, Sydney (ap-southeast-2). Every query is scoped to your tenant in the API.
We process it
Pulse and reports run on our Sydney application compute. AI features send the relevant text to overseas inference providers, which are asked not to train on it. AI inference may be processed outside Australia.
You export it
One-click export to CSV / PDF / accountant package, any time. No lock-in.
You leave
Export your data any time. Ask us in writing to delete your account: after a 30-day cooling-off we delete it, except financial and payroll records we must keep for tax and Fair Work purposes.
Compliance
Built for what the ATO and Fair Work expect.
You shouldn’t need a compliance officer to use accounting software. XAIO ships with the AU regulatory defaults already configured, and keeps the audit trail that proves it.
- STP Phase 2 reporting is built and in ATO testing; production lodgement is not yet live (ATO Digital Service Provider registration in progress)
- BAS preparation with validation
- GST coding aligned to ATO category mapping
- Payslips designed to meet Fair Work record-keeping requirements
- Audit log for every books, payroll and HR change
- Australian Privacy Principles (APPs), Privacy Policy
What your auditor sees
Every change, attributed.
- 09:42
invoice INV-0042 approved
- 09:43
journal J-1287 posted
by approve_invoice RPC
- 09:44
pulse_action draft_reminder approved
- 11:02
tax code GST → Coffee changed
- 14:28
pay run PR-0021 finalised
Every books, payroll and HR change is attributed and time-stamped.
Operations
When something goes wrong, we tell affected customers directly.
Scheduled monitoring of key endpoints, and direct communication when an incident affects you.
Real-time monitoring
Automated uptime checks run against login and key API endpoints on a schedule. They are probes, not a guarantee of instant detection.
Incident response
The founder-led engineering team investigates incidents and contacts affected customers directly. There is no 24/7 on-call roster or response-time guarantee.
Backups + restore
Automated database backups are provided by our hosting platform. A full restore test has not yet been completed and recorded, so we do not claim a tested recovery.
Found a vulnerability?
We work with security researchers under a responsible-disclosure policy. Email [email protected] with steps to reproduce. We will acknowledge your report promptly and ship a fix according to severity.
Trust is a feature. We ship it first.
AU-hosted, encrypted, tenant-scoped, audit-logged.
Everything happens once.