§ Security — overview
Last reviewed · 09 Aug 2026

What we do to keep your books safe.

Ziroo holds two things of value on your behalf: the OAuth credentials that let us read your Xero data and write to your chosen cloud storage, and the accounting metadata we fetch on your schedule. This page is a plain, factual account of how each of those is handled — and, just as importantly, the industry terms we deliberately do not claim to meet.

/01 — Transport

Encrypted in transit

All traffic between your browser, Ziroo, Xero, your cloud provider, and our email infrastructure uses TLS 1.2 or higher. AES-256 is the typical cipher negotiated by modern clients. Plain HTTP is redirected; HSTS is enabled for our domain.

/02 — Credentials at rest

Secrets are encrypted in the database

OAuth access and refresh tokens — for Xero, Dropbox, Google Drive, and Microsoft OneDrive — are encrypted at rest using Laravel’s AES-256-CBC cipher with a per-environment master key. The same applies to two-factor authentication secrets and recovery codes. Passwords are hashed with bcrypt (work factor 12).

/03 — Xero access

We only read

We request the openid, profile, email, accounting.transactions.read, and offline_access scopes from Xero. We only perform read operations against the Invoices, Quotes and Purchase Orders endpoints. We never create, update, or delete records in your Xero organisation.

/04 — Zero-custody storage

Your PDFs go to your cloud

PDFs from Xero are written to temporary storage on our server, uploaded to the cloud provider you connected (Dropbox, Google Drive, or OneDrive), then removed by a cleanup job. Long-term archive copies live in your storage account, not ours.

/05 — Account security

Two-factor and session hygiene

Time-based (TOTP) two-factor authentication is available on every account and strongly recommended for bookkeepers and multi-organisation users. Session cookies are HttpOnly, SameSite=Lax, with a 120-minute idle lifetime; the CSRF token is required on every state-changing request.

/06 — Infrastructure

Hosted on DigitalOcean (Australia)

The application and its database run on the same DigitalOcean server in Australia. We rely on DigitalOcean’s physical-security and network-isolation controls for the underlying host; we are responsible for OS, application, and database patching on that server. Outbound transactional mail is delivered via Amazon SES (the only AWS service we use).

/07 — Operational controls

Backup run records

We record the outcome of backup runs: when a run started, which organisation and document kind it covered, and whether fetch and delivery succeeded or failed. We do not currently provide a full user-facing audit trail of every team setting change (for example every connection or storage edit).

/08 — Dependencies

Framework updates tracked

Ziroo is built on Laravel 13 and maintained PHP dependencies. We track upstream security advisories and apply patches as part of normal maintenance.

/09 — Payment data

We never see your card

Billing is handled by Stripe. Card numbers and full payment details are entered into Stripe’s PCI‑DSS Level 1 certified environment and never transit our servers. We only store a Stripe customer reference and the last four digits of the card for display.

§ What we don’t claim

Straight about
our limits.

§ Responsible disclosure

Found something?
Tell us.