What we do to keep your books safe.
Ziroo holds two things of value on your behalf: the OAuth credentials that let us read your Xero data and write to your chosen cloud storage, and the accounting metadata we fetch on your schedule. This page is a plain, factual account of how each of those is handled — and, just as importantly, the industry terms we deliberately do not claim to meet.
Encrypted in transit
All traffic between your browser, Ziroo, Xero, your cloud provider, and our email infrastructure uses TLS 1.2 or higher. AES-256 is the typical cipher negotiated by modern clients. Plain HTTP is redirected; HSTS is enabled for our domain.
Secrets are encrypted in the database
OAuth access and refresh tokens — for Xero, Dropbox, Google Drive, and Microsoft OneDrive — are encrypted at rest using Laravel’s AES-256-CBC cipher with a per-environment master key. The same applies to two-factor authentication secrets and recovery codes. Passwords are hashed with bcrypt (work factor 12).
We only read
We request the openid, profile, email, accounting.transactions.read, and offline_access scopes from Xero. We only perform read operations against the Invoices, Quotes and Purchase Orders endpoints. We never create, update, or delete records in your Xero organisation.
Your PDFs go to your cloud
PDFs from Xero are written to temporary storage on our server, uploaded to the cloud provider you connected (Dropbox, Google Drive, or OneDrive), then removed by a cleanup job. Long-term archive copies live in your storage account, not ours.
Two-factor and session hygiene
Time-based (TOTP) two-factor authentication is available on every account and strongly recommended for bookkeepers and multi-organisation users. Session cookies are HttpOnly, SameSite=Lax, with a 120-minute idle lifetime; the CSRF token is required on every state-changing request.
Hosted on DigitalOcean (Australia)
The application and its database run on the same DigitalOcean server in Australia. We rely on DigitalOcean’s physical-security and network-isolation controls for the underlying host; we are responsible for OS, application, and database patching on that server. Outbound transactional mail is delivered via Amazon SES (the only AWS service we use).
Backup run records
We record the outcome of backup runs: when a run started, which organisation and document kind it covered, and whether fetch and delivery succeeded or failed. We do not currently provide a full user-facing audit trail of every team setting change (for example every connection or storage edit).
Framework updates tracked
Ziroo is built on Laravel 13 and maintained PHP dependencies. We track upstream security advisories and apply patches as part of normal maintenance.
We never see your card
Billing is handled by Stripe. Card numbers and full payment details are entered into Stripe’s PCI‑DSS Level 1 certified environment and never transit our servers. We only store a Stripe customer reference and the last four digits of the card for display.
Straight about
our limits.
We think the fastest way to lose trust is to imply compliance or controls we can’t substantiate. So, explicitly:
- We are not SOC 2 certified. We have not undergone a SOC 2 Type I or Type II audit, and we don’t describe ourselves as “SOC 2 aligned” — that phrase is fuzzy by design, and we’d rather describe what we actually do.
- We are not ISO 27001 certified.
- We do not claim full-database or full-disk encryption at rest. The specific fields that hold secrets (OAuth tokens, 2FA material, and encrypted storage settings) are encrypted. Other database columns are stored on our DigitalOcean server without claiming full-disk or full-database encryption.
- We have not commissioned an independent penetration test at our current stage. We intend to as the business grows.
- We do not offer multi-region or customer-selectable data residency. Application and database data are stored in Australia on DigitalOcean. Some subprocessors (for example Amazon SES for outbound email, Stripe for billing, and the cloud storage provider you connect) process data outside Australia. If strict single-jurisdiction residency is a requirement, confirm that model fits before you subscribe.
If any of the above changes, we’ll update this page before we update marketing copy elsewhere.
Found something?
Tell us.
If you believe you’ve found a security vulnerability in Ziroo, please report it via the Contact page and choose the topic Security report. Please include:
- A description of the issue and the URL or endpoint affected
- Steps to reproduce, and any proof-of-concept output
- Your assessment of the impact
We will acknowledge receipt within five business days, keep you updated while we investigate, and credit you (if you’d like) when the issue is resolved. Please do not perform testing that could affect other customers’ data or availability, and please give us a reasonable window to fix the issue before public disclosure.
We do not currently operate a paid bug-bounty programme.
§ Related