Security

Security

HTTPS on every page, including login.

Authentication is handled by this app’s account service (Google, X, or email). Every invoice query is scoped to the signed-in user on the server.

AI extraction runs server-side. The browser never receives the model key.

Inbound email attachments are processed only for the matching account alias. Unknown aliases are discarded.

Xero tokens

Access and refresh tokens are stored server-side only, per BillFlow user. They never appear in the browser or in frontend bundles. The client secret is never a `VITE_` variable. An operator connecting Xero does not connect customers.

Redirect URI: https://billflowai.co.uk/api/xero/callback

Scopes requested — and no others:

openid profile email offline_access accounting.contacts accounting.invoices accounting.attachments accounting.settings

BillFlow Ai pushes ACCPAY drafts only. It never authorises a bill, never touches bank payments, never creates sales invoices, and never requests accounting.transactions.

Connection labels

The product shows Not connected, Demo, Live, or Reconnect required. Demo is never labelled Live. See Connect, reconnect, disconnect.

Breach notice

If Xero tokens or invoice files leak, we will email api@xero.com and the affected users. Write to us at billflowai@gmail.com.