Security

This page sets out the facts a practice usually needs for its compliance file. The full policy is at /privacy and the data processing terms are at /dpa. If your file needs something not covered here, write to hello@ratelift.app.

Where is it hosted?

The app and its database run in London, on Vercel and Neon.

Does any data leave the UK?

Vercel and Neon are US-owned and may handle data in the US for support, under standard transfer safeguards.

How is it encrypted?

Xero tokens are encrypted at rest with AES-256-GCM, and every connection uses TLS.

What does it read from Xero?

Repeating-invoice templates, branding themes, your chart of accounts and tax rates (at an import preview or a pre-filled file), a few organisation settings (country, tax edition, currency, time zone and payment terms) and, after a run, the invoices those templates raised.

What does it never read?

Bank data, payroll or reports.

Does it read contacts?

Yes, read-only: each contact's name, status, default sales account and sales payment terms, at an import preview (to find archived contacts) and when you download the pre-filled import file. None of it is stored.

What does it store?

A copy of each template previewed or changed, and the run history, so that undo works and nothing is repriced twice.

What is in those copies?

Whatever is on the template, such as customer names and line descriptions.

How do you delete it?

On request, everything held for an organisation is deleted within 30 days.

How is a connection removed?

On request, on declining new terms, or after 13 months unused and one email to the organisation.

Is Xero data sent to AI?

The app sends no Xero data to any AI service.

Who has access?

Access is limited to the company's director.

What if there is a breach?

We report a personal data breach affecting Xero data to Xero, to the customers affected without undue delay, to the Information Commissioner's Office where required and, for a New Zealand organisation's data, to the Office of the Privacy Commissioner where the Privacy Act 2020 requires it.

Is there insurance?

The company holds professional indemnity and cyber insurance.