Xero
Accounting · xero.com · last read 2026-10-12
Identity
| Legal entity | Xero (NZ) Limited |
|---|---|
| HQ | NZ |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | xero.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Not stated | — | xero.com | 2026-10-08 |
Subprocessor chain
21 third parties · 11 of the vendor's own group companies · 29 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Adobe | US | Electronic signing service provider |
| Amazon Web Services | US | Cloud infrastructure service provider |
| Anthropic | US | Conversational artificial intelligence services |
| Avalara | US | Sales tax look-up (United States) |
| CloudFactory | GB | Data extraction and processing |
| Confluent | US | Cloud infrastructure service provider |
| Datadog | US | Cloud monitoring service provider |
| Fivetran | US | Cloud infrastructure services provider |
| Google Cloud Platform | US | Cloud infrastructure service provider |
| Infosys | IN | Technology consulting provider |
| Mailgun Technologies | US | Transactional email processing |
| Microsoft Azure | US | Cloud infrastructure service provider |
| Mixpanel | US | Platform instrumentation |
| OpenAI | US | Conversational artificial intelligence services |
| Snowflake | US | Cloud infrastructure service provider |
| Stripe | US | Online payment processing |
| Sumo Logic | US | Cloud monitoring service provider |
| Superchoice | AU | Payroll processing (Australia) |
| Tink | GB | Bank feed aggregator (UK) |
| Twilio Inc | US | cloud communications provider |
| Yodlee | US | Bank feed aggregator (US) |
Xero's own group companies listed as subprocessors (11)
| Company | Country | Purpose |
|---|---|---|
| Syft Analytics Group South Africa Proprietary Limited | — | support and similar services |
| Syft Analytics Inc. | — | support and similar services |
| Syft Analytics Operations South Africa Proprietary Limited | — | support and similar services |
| Xero (NZ) Limited | NZ | support and similar services |
| Xero (Singapore) Pte. Ltd. | SG | support and similar services |
| Xero (UK) Limited | GB | support and similar services |
| Xero Australia Pty Limited | AU | support and similar services |
| Xero Limited | NZ | support and similar services |
| Xero Software (Canada) Ltd. | CA | support and similar services |
| Xero South Africa (Pty) Ltd. | ZA | support and similar services |
| Xero, Inc. | US | support and similar services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · xero.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 30 days' notice, by updating its online sub-Processors page |
| If you object to one | Customer may object on reasonable data protection grounds within 14 days of notice; Xero will discuss a resolution; if none is possible, Xero may decline the appointment or suspend/terminate on one month's notice, or Customer may terminate on one month's written notice |
| If you object to one | If the objection can't be resolved, Customer may terminate the Agreement with one month's written notice |
| Breach notification | without undue delay |
| Audit | Xero audited against SOC 2 and ISO/IEC 27001:2022 by an independent third party; on request, subject to confidentiality, a copy of the SOC 2 report is provided to the customer or its non-competitor third-party auditor. No on-site audit right is stated in this part. |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO/IEC ISO27001:2022 · ISO27001 | Available on request | — | xero.com | 2026-10-08 |
| PCI DSS v4.0, SAQ A · PCIDSS | Claimed | We're a level 2 merchant & outsource card processing to level 1 providers. | xero.com | 2026-10-08 |
| SOC 2 · SOC2 | Available on request | Xero’s cloud-based accounting system | xero.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Xero
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Xero
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Xero
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Xero
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Xero
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Xero
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.