Security & Data Protection

How Vextor protects your financial data — storage, encryption, Xero access, and GDPR compliance.

Data Storage

Your financial data is stored on Microsoft Azure infrastructure (EU West / Amsterdam region).
Data is held in isolated per-client directories — no client can access another client's data.
We store only what's needed to generate your reports: account mapping, aggregated financial figures, and forecast assumptions.
We do not store raw transaction-level data beyond what Xero provides in its summarised API responses.
All data is encrypted at rest using AES-256.

Data in Transit

All browser connections use TLS 1.3 (HTTPS).
Connections to Xero use OAuth 2.0 over HTTPS — your Xero credentials are never passed to or stored by Vextor.
Our Cloudflare-protected infrastructure provides DDoS protection and additional TLS termination.

Xero Integration & OAuth Scope

When you connect Xero, Vextor requests read-only access using these OAuth 2.0 scopes:

Scope	Why we need it
`accounting.reports.trialbalance.read`	To read your trial balance data
`accounting.reports.balancesheet.read`	To read your balance sheet data
`accounting.invoices.read`	To read your invoice and bill data
`accounting.settings.read`	To read your chart of accounts and organisation settings
`openid`, `profile`, `email`	To identify your Xero organisation

We request no write scopes. Vextor cannot modify your Xero data in any way. You can revoke access at any time from Xero under Settings → Connected Apps.

Access Controls

Authentication: Magic link login — no passwords stored. Links are single-use, expire in 15 minutes, and are sent only to your verified email address.
Sessions: Encrypted server-side; you're signed out automatically after 60 minutes of inactivity, and sessions are never remembered across browser restarts — closing your browser signs you out. Signing back in is a fresh magic link, every time.
Licence enforcement: Each licence is tied to a Xero organisation (tenant ID).
Staff access: Our team can access infrastructure logs for support purposes. We do not read your financial data except when diagnosing an issue you have raised with us.

GDPR & Data Protection

Vextor (McMillan Grubb Ltd) acts as a data processor on behalf of your firm (the data controller).
Data retention: Data is held for the duration of your active subscription plus 30 days, then permanently deleted.
Subject rights: Request access, correction, or deletion at any time — email [email protected].
We do not sell, share, or transfer your data to third parties, except to infrastructure providers (Azure, Cloudflare) bound by equivalent obligations.
Full Privacy Policy: vextor.tech/privacy.

Incident Response

Systems are monitored 24/7 with automated alerting.
In the event of an incident affecting your data, we will notify affected clients within 72 hours, in line with GDPR Article 33.
To report a security concern: [email protected].