What XPlor can and cannot do
Can: read invoices, bills, contacts, and transactions from your accounting system through its official API; read bank balances and transaction activity; build forecasts, briefings, and alerts from that data.
Cannot: move money, initiate payments, or transfer funds — there is no code path for it. Cannot modify, create, or delete records in your accounting system under the read-only connection. Cannot see your bank username or password: bank connections use a dedicated provider, and your credentials are entered with the provider, never with us.
How connections work
Accounting (Zoho Books today). You authorize XPlor through Zoho's own OAuth consent screen, scoped to read access. You can see and revoke that grant at any time from your Zoho account — revocation cuts XPlor off immediately, no support ticket required.
Banks. Bank connectivity runs through a regulated aggregation provider. You authenticate with your bank inside the provider's flow; XPlor receives read-only balance and transaction data, never your login.
How your data is protected
Encryption. Data is encrypted in transit (TLS) and encrypted at rest by our infrastructure providers.
Isolation. Every row of financial data is bound to your organization, and database-level row security enforces that boundary on every query — isolation is a property of the database, not a convention in application code.
Determinism as a security property. XPlor's numbers are computed by deterministic rules over your records — the AI explains results, it does not fabricate or transform your financial data. That's a trust decision as much as an accuracy one: a system whose outputs are reproducible is a system whose behavior can be audited.
What we don't do with your data
We don't sell it. We don't share it with third parties beyond the infrastructure required to run the product. We don't train shared models on your books. When you leave, you can request deletion of your organization's data and we will honor it.
Where we are honest about maturity
XPlor is an early-access product built by a small team, and we'd rather tell you that than hide it behind a wall of compliance badges. Formal certifications are on the roadmap as the company grows. In the meantime, we'll answer any security question directly — including detailed ones about architecture, data flows, or subprocessors: contact@xplor.so. If your question is “can I see exactly what access XPlor has to my systems,” the answer is yes, in your own Zoho and bank provider dashboards, right now.