/Education
Education 6 min read
How XIntelliSync Handles Your Data — Security, Privacy, and Compliance
"Your financial data is the most sensitive data your business has. Here's how we protect it."
Your financial data is the most sensitive data your business has. Here is exactly how XIntelliSync protects it — no marketing language, just the technical facts.
Data Isolation
Every database query is filtered by your user ID or organisation ID. This is enforced at the database level through Row Level Security (RLS) policies — not just in application code. Even if a bug existed in the application layer, the database itself prevents cross-user data access.
100% of user data tables have Row Level Security policies. No exceptions.
Authentication & Sessions
Security measures for your account:
- Session tokens use sessionStorage — cleared when you close your browser tab
- JWT tokens expire after 1 hour with automatic refresh
- Login is protected by hCaptcha to prevent automated attacks
- Rate limiting prevents brute-force login attempts
Third-Party Integrations
When you connect Xero, QuickBooks, Shopify, Stripe, or other services:
- OAuth 2.0 is used for all direct integrations — XIntelliSync never stores your third-party login credentials
- OAuth tokens are encrypted at rest
- Bank feed connections via Basiq are read-only — no payment capabilities
- You can disconnect any integration at any time from Settings