Security

How we protect your Xero connection and data, and how to report a security problem.

Report a vulnerability

Email security@sectiontotal.com. We aim to reply within 2 business days. Machine-readable contact details are in security.txt.

Good-faith research is welcome within these rules:

In scope: sectiontotal.com, the website and your dashboard. Anything not listed is out of scope, including our status page and email-sending subdomains, which other companies run.
Use only your own accounts and your own Xero demo company. Do not access, change or delete anyone else's data.
No denial of service, spam, social engineering or physical attacks.
Do not test the services we use, such as Xero, Stripe and our email and hosting providers; report issues in their services to them.
Give us reasonable time to fix an issue before you publish it.

We will not pursue legal action against research that follows these rules.

You sign in with Xero. We never see or store a password.
Your data is encrypted at rest, and in transit between you, us and our providers. We store it mainly in the EU; our providers page says where each service is.
We never change an invoice's lines, totals or tax. We add our PDF to the invoice and mark it as sent.
We sign you out after a period without activity. You can sign out of every device from your Account page.