Security
One account’s data never reaches another account
That property matters more than any other on this platform. Every check below exists to protect it, and the isolation logic is exercised the same way whether a request comes through an API key, the customer interface, or the admin control plane.
Tenant isolation, tested adversarially
These are the specific attacks we run against the platform itself, and each one has to fail closed:
- A key issued to one account, used against an org that belongs to a different account
- A forged or guessed Xero-Tenant-Id header on an otherwise valid key
- Org IDs enumerated in sequence to find a valid tenant outside the caller's account
Data protection
Handling the credentials you’ve trusted us with
Envelope encryption at rest
Xero access and refresh tokens are never stored in plain text. Every connection's tokens are encrypted with a key that is itself encrypted, so a database copy alone is not enough to read them.
Tokens never leave the vault
Access and refresh tokens are excluded from logs, error messages, traces and the admin interface by construction, not by a filter applied afterwards.
Bodies are not logged by default
Request and response bodies carry financial data, so they're excluded from the standard audit trail. Capturing a body is an explicit, time-boxed, per-key debug toggle, and turning it on is itself an audited action.
Hash, never store, the key secret
An API key's secret is shown exactly once, at creation. From then on we hold only its hash, looked up by key ID and verified with a constant-time comparison.
Account security
Getting in is deliberately slow to abuse
- Passwords hashed with Argon2id, checked against known-breached lists, no arbitrary composition rules
- One-time codes are single-use, short-lived, and compared in constant time
- Sessions are short-lived and rotate on any privilege change
- Every account can see and remotely revoke its own active sessions
- Repeated failed logins and OTP attempts are rate-limited and lock out
Compliance and residency
Held to the same bar as the rest of the estate
All platform data is resident in Australia. The platform is built to the same control bar as our other products, aligned with ISO 27001 and SOC 2, and to Xero’s own security requirements for connected apps.
Cross-account super admin access is written to an immutable audit log with a reason field, and the platform’s own authentication and key-management endpoints are rate-limited independently of the proxy traffic passing through them.
Ready to see the request path itself?
Walk through exactly what happens between a downstream app and Xero.
How it works