Security and data handling

Written for the person who has to approve this. One page, no marketing, and we have tried to be plain about the limits as well as the protections.

What we access

Four read-only Xero scopes, and nothing else:

• accounting.invoices.read — sales invoices and credit notes
• accounting.contacts.read — customer names and contact details
• accounting.settings.read — your organisation's name, currency and time zone
• offline_access, openid, profile, email — to keep the connection alive and sign you in

We hold no write permission of any kind, and no permission to read payroll, bank transactions, bank feeds, bills, purchase orders or payments. Those scopes were never requested, so they cannot be used by mistake or by a future change on our side.

Where data lives

A PostgreSQL database hosted by Render in Singapore, with daily backups. All traffic is over TLS. Your Xero refresh tokens are encrypted by us before they are stored, with rotating keys, so a database copy alone does not grant access to your Xero account.

If data residency in Australia is a requirement for you, tell us — it is a configuration change rather than a rebuild, and worth knowing before you sign up.

Who can see it

Access follows Xero. Anyone who can see your organisation's invoices in Xero can sign in here and see our reports on them. We deliberately do not run a second permissions system: a separate set of roles would drift out of step with Xero's and give you two things to maintain.

Everyone on an account is emailed when somebody new signs in, and the account page lists who currently has access. Remove someone in Xero and they lose access here.

On our side, access is limited to the operator, for support and fault-finding. We will tell you if we ever need to look at your data to resolve something.

What we do with it

Each business's figures are used only to produce that business's own reports. They are never pooled with other businesses, never used for benchmarking, and never used to train machine-learning models — which is also a condition of Xero's developer terms. It is the reason we do not offer industry comparisons.

We do not sell data, and there is no advertising anywhere in the product.

How long we keep it

• Disconnect and every invoice, contact and report we hold for that organisation is deleted immediately.
• A connection that stays broken for 30 days is deleted automatically.
• Sent emails are pruned after 30 days; audits after a year.
• Retention is enforced by a nightly job, not by hand.

Sub-processors

• Xero — the source of the data
• Render — hosting and database, Singapore
• Resend — email delivery
• Stripe — payments. Card details go directly to Stripe; we never see or store a card number.

There are no analytics or advertising trackers on this site.

What we do not have

We would rather you heard this from us than found out later:

• No SOC 2 or ISO 27001 certification.
• No formal uptime guarantee. We aim to respond to faults within one business day, and the operator is alerted automatically when something breaks.
• No single sign-on beyond Xero, and no role-based permissions — see above.
• We are a small operation. If that is a problem for your procurement process, it is better to know now.

Reporting a problem

Security issues: support@flowcatch.app. We will acknowledge within one business day and keep you informed until it is resolved. If you believe data has been exposed, say so in the subject line and we will treat it as urgent.

See also our privacy policy and terms. Last reviewed November 2026.