What Inala can see, and how we look after it

Read-only access to Xero

Inala asks Xero for read access only. These are the exact permissions on the Xero screen:

• Your name and email address (openid, profile, email)
• Staying connected between visits (offline access)
• Reading transactions: invoices and payments
• Reading contacts
• Reading reports: the profit and loss
• Reading settings: your chart of accounts

There is no permission that lets Inala create, change or delete anything in Xero, so it cannot.

Your Xero connection

The keys Xero gives us are encrypted with AES-256-GCM before they are stored. They are only ever decrypted inside our server, at the moment a sync runs. They are never sent to your browser and never written to logs.

Inala syncs once a day and when you press Sync now (at most once every 10 minutes), and keeps within Xero's limit of 60 calls a minute. Disconnecting in Settings deletes Inala's stored keys straight away and removes the connection at Xero, unless another business you run in Inala uses the same Xero organisation. You can also remove Inala at any time under Connected apps in Xero.

Each business is kept apart

Every request checks that you are a member of the business you are asking about, and what your role allows. A test runs every server function as a person from another business and fails the build if any of them returns data.

Signing in

You sign in with Auxo ID, which confirms your email address with a one-time code. Inala has no passwords of its own to leak. An invite only works for the email address it was sent to.

Where your data lives

Inala runs on Convex (database and server functions) and Vercel (the website). Data is encrypted in transit and at rest by those providers. We do not sell your data or use it for advertising.

Deleting your data

An owner can delete the business in Settings by typing its name. That removes every invoice, client, budget, chase and log entry we hold for it, and disconnects Xero in the same way. You can export everything as CSV first.

Reporting a problem

If you think you have found a security issue, email support@auxodigital.africa with the details.