Security

Reportpost reads financial data from Xero, so here's plainly how we look after it.

Access to Xero

• You connect with Xero's own sign-in. We never see your Xero password, and if you use Xero's two-step verification, it protects this sign-in too.
• Access is read-only and limited to what the reports need: report data, invoices and bills, payments and credit notes, and basic organisation settings. Reportpost can't create, change or delete anything in Xero.
• You can disconnect an organisation from your dashboard, or remove Reportpost in Xero under connected apps, at any time. If your trial or plan ends, we remove our access automatically after two weeks.

Your data

• Report figures are fetched when a report is sent, turned into the PDF, Excel or CSV attachment and emailed. We don't keep copies of the reports.
• Xero access tokens are encrypted (AES-256-GCM) and the key is kept separately from the database.
• Reports only go to the recipients you set up. Replies go to you.
• We never use your Xero data to train AI or machine learning models, and we don't sell or share it.

Where it runs

• Servers are in Germany (Hetzner). All traffic is encrypted with TLS.
• The app runs as an isolated, unprivileged service behind a firewall, with security updates applied automatically, monitoring and nightly backups.
• Card payments are handled by Stripe; we never see card numbers.

If something goes wrong

We have a written incident plan. If we ever found that your data had been exposed, we'd contain it, tell you without delay and notify the authorities as the law requires.

Closing your account

You can close your account from the billing page. That disconnects Xero, cancels any subscription and deletes your schedules and settings.

Questions or a security concern? Email support@reportpost.app. More detail is in our privacy policy.