Xero Privacy & Data Security

How Hour Cap handles your Xero data, what we access, and how we keep it secure.

Overview

Hour Cap integrates with Xero to turn tracked time into draft invoices. It syncs reference data, creates drafts when you request them, and checks the status of invoices created through Hour Cap so the invoice list reflects changes made in Xero.

This page explains exactly what data Hour Cap accesses from your Xero account, how that data is stored and protected, and what happens when you disconnect. It is intended to help you evaluate whether the integration meets your organisation's privacy and security requirements.

For general documentation on using the Xero integration, see the Xero Integration Support page.

OAuth permissions & scopes

When you connect Hour Cap to Xero, you are asked to authorise a specific set of permissions (OAuth 2.0 scopes). Hour Cap requests the following scopes:

  • accounting.contacts — Read and create contacts. Used to sync your active customer contacts and optionally create new contacts when invoicing.
  • accounting.invoices — Read invoices created through Hour Cap, create drafts, and delete a draft when you request it.
  • accounting.settings — Read-only access to chart of accounts, tax rates, branding themes, currencies, items, and tracking categories. Used to populate invoice configuration options.
  • openid, profile, email — Standard OpenID Connect scopes. Used only during the Xero signup flow to pre-fill your name and email address when creating a new Hour Cap account.
  • offline_access — Allows Hour Cap to refresh your access token without requiring you to re-authorise. This is what keeps the connection active between sessions.

Hour Cap does not request access to bank transactions, payroll, reports, or any other Xero data beyond the scopes listed above.

Single organisation access only

If your Xero login has access to multiple organisations, Hour Cap only connects to the single organisation you select during the authorisation flow. It has no access to any of your other Xero organisations. The connection is scoped to one Xero tenant ID, and all API calls are made exclusively against that organisation.

The authorisation flow uses Proof Key for Code Exchange (PKCE) with the S256 challenge method. This prevents authorisation code interception attacks by ensuring that only the application that initiated the authorisation request can exchange the code for tokens.

Data read from Xero

Hour Cap reads the following data from your Xero organisation:

Contacts

Hour Cap syncs contacts that are both active and flagged as customers in Xero. It stores the contact name and Xero contact ID for client linking. When Xero provides email addresses for a contact or its contact people, Hour Cap can also add those addresses to the linked client's contact emails for matching incoming messages in the optional inbox. It does not store Xero phone numbers or physical addresses in client records.

Items

Xero inventory items marked as "sold" are synced to Hour Cap. The fields stored are: item code, name, description, unit price, account code, and tax type. These are used to pre-fill invoice line item configuration.

Tracking categories

If you use tracking categories in Xero (e.g. departments, cost centres), Hour Cap syncs their names, statuses, and options. These are stored locally so you can assign tracking to invoice line items.

Invoice status

For invoices created through Hour Cap, we retrieve the Xero invoice ID and status, whether it was sent to the contact, and the amount paid. When you ask to delete a draft, we also check whether a payment or credit has been applied. We use these fields to show whether the invoice is draft, awaiting approval, approved, sent, part paid, paid, deleted, or voided, and to protect invoices that are no longer drafts. We do not import your other Xero invoices or store Xero payment records or bank transactions.

Xero can notify Hour Cap when one of these invoices changes. We then fetch its current status from Xero. Open invoices are also checked in batches when you log in and during a daily sync. Opening the invoices page can check them before displaying the page, at most once every five minutes per organisation; if the short API call cannot complete or more than 100 invoices need checking, the refresh runs in the background. Paid invoices are excluded from routine checks, but a later Xero update can trigger a recheck if a payment is reversed.

Cached reference data (not stored in the database)

The following data is fetched from Xero and held in a temporary cache for up to 1 hour. It is used to populate dropdown menus when configuring invoice defaults and is never written to the database:

  • Tax rates
  • Revenue accounts (chart of accounts, filtered to revenue type only)
  • Branding themes
  • Currencies

After the 1-hour cache expires, the data is fetched again from Xero on the next request that needs it.

Data written to Xero

Hour Cap makes these changes in Xero only when you explicitly initiate them:

  • Draft invoices: When you create an invoice in Hour Cap and push it to Xero, it is created as a draft invoice. You must review and approve it in Xero before it is sent to your client. Invoice data includes the contact reference, line items (description, quantity, rate, account code, tax type, tracking), due date, reference number, currency, and branding theme.
  • New contacts: If you choose to invoice a client that is not yet linked to a Xero contact, you can optionally create a new contact in Xero. Only the client name is sent.
  • Draft deletion: If you choose Delete for an invoice that is still a draft, Hour Cap checks its current status in Xero and deletes it there. The associated time or fixed charge becomes available to invoice again in Hour Cap.

Hour Cap does not send or approve invoices for you, change their line items after creation, or delete invoices that have moved beyond draft status. Reading invoice status does not change the invoice in Xero.

Data storage & encryption

OAuth tokens

Your Xero OAuth access token and refresh token are encrypted at rest using AES-256-CBC encryption via Laravel's built-in encryption layer. The encrypted values are stored in the database. They can only be decrypted using the application's encryption key, which is stored separately from the database.

Synced data

Contact names, contact email addresses added to clients, item details, tracking categories, and the latest status of invoices created through Hour Cap are stored in the application database alongside your other Hour Cap data. Invoice records also retain their Xero ID and number and the invoice details captured when they were created. This data is scoped to your organisation. No Xero data is shared between organisations.

Cached data

Tax rates, revenue accounts, branding themes, and currencies are held in a temporary application cache. This data expires automatically after 1 hour and is not persisted to the database.

Token security

Hour Cap implements several measures to protect your Xero OAuth tokens:

  • PKCE (S256): The authorisation flow uses Proof Key for Code Exchange with the SHA-256 challenge method, preventing authorisation code interception.
  • Encrypted storage: Both the access token and refresh token are encrypted at rest using AES-256-CBC before being written to the database.
  • Automatic refresh: Access tokens are refreshed automatically 5 minutes before they expire, so your connection stays active without manual intervention.
  • Distributed locking: Token refresh operations use a distributed lock to prevent concurrent refresh attempts from causing token invalidation.
  • Revocation on disconnect: When you disconnect from Xero, Hour Cap sends a revocation request to Xero's identity server to invalidate the refresh token, then deletes the connection record from the database.

Disconnecting

When you disconnect Hour Cap from Xero (via Settings → Xero → Disconnect from Xero), the following cleanup is performed:

  1. Token revocation: The refresh token is revoked with Xero's identity server, immediately invalidating Hour Cap's access.
  2. Connection record deleted: The stored OAuth tokens, tenant ID, and connection metadata are permanently deleted from the database.
  3. Xero contact links cleared: All Xero contact IDs are removed from your client records, unlinking them from Xero contacts.
  4. Xero item and tracking references cleared: Xero item IDs and tracking option assignments are removed from your project records. Organisation-level tracking defaults are also cleared.
  5. Tracking categories deleted: All synced tracking category data is permanently deleted.

What is retained after disconnecting

The following data is not deleted when you disconnect, as it belongs to your Hour Cap account and may be needed for your records:

  • Invoices: Historical invoice records are retained for your audit trail, including their latest status, Xero ID and number, and the line item snapshot captured at creation. Disconnecting stops further status updates.
  • Time entries: All tracked time entries remain unchanged.
  • Clients and projects: Your client and project records remain, with Xero-specific references removed. Contact email addresses already added to clients are retained for inbox matching and can be edited in Hour Cap.
  • Synced items: Xero item records are retained for reference but are no longer used once disconnected.

You can reconnect to Xero at any time. Reconnecting will require you to re-authorise and re-map your clients to Xero contacts.

Third-party sub-processors

Hour Cap uses the following infrastructure providers that may process data related to your Xero integration:

  • Hosting provider: The application and database are hosted on secure cloud infrastructure. All data is encrypted in transit (TLS) and the database is not publicly accessible.
  • Queue processing: Xero sync operations and invoice pushes run as background jobs on the same infrastructure as the application.

Hour Cap does not share your Xero data with any other third parties. Your Xero data is not used for analytics, advertising, or any purpose other than providing the invoicing features described in this document.

Compliance

Hour Cap is an Australian company and handles personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988.

  • Data minimisation: Hour Cap uses Xero data for invoicing and client inbox matching. Contact email addresses may be stored for that matching; bank transactions and payroll are not accessed.
  • Purpose limitation: Xero data is used to sync invoicing reference data, match client emails in the optional inbox, create and, when requested, delete draft invoices, and keep their status current in Hour Cap. It is not used for any other purpose.
  • Data retention: Disconnecting removes the connection and the Xero-specific references listed above. Historical invoice records and contact email addresses already added to clients remain in Hour Cap until you remove them or delete your account.
  • Right to deletion: You can disconnect from Xero at any time to remove the connection and the references listed above. To permanently delete your account and all associated data, go to Settings → Close account.

Contact

If you have questions about how Hour Cap handles your Xero data, or if you need additional documentation for your compliance requirements, please contact us at [email protected].