Security and data

What Duewick can access in Xero

The Xero connection asks only for read access:

• stay connected between sessions (offline_access)
• read contacts
• read invoices and credit notes
• read payments
• read organisation settings

It cannot create, change or delete anything in Xero, and it does not ask for bank transactions, payroll, files or manual journals. Xero connection tokens are encrypted at rest (AES-256-GCM). You can also upload invoice files instead of connecting Xero.

Where data is stored and processed

• Database, sign-in and file storage: Supabase, in Sydney, Australia. Each business’s records are separated with row-level security on every table.
• Website, application and the agent’s email sending and receiving: Cloudflare. Sign-in and support emails: Google Workspace.
• AI processing for reading files and replies: OpenAI’s API. This processing may take place outside Australia. We do not run model-training jobs using customer invoices or conversations; we do not claim zero retention by providers.
• Card payments: Stripe. Duewick does not store full card numbers.

The full list of providers is in the Privacy Policy.

How each action is authorised

• Nothing is sent to your customers until you have brought in your invoices, agreed the agent’s limits (hours, tone, exclusions and what it may offer) and switched it on.
• The AI reads and drafts. Before any email goes out, fixed rules check it against your limits and against open disputes, payment claims, hardship and do-not-contact requests. A message that fails a check is not sent.
• You can choose to approve every message before it is sent, edit the limits or pause the agent at any time.
• Sending checks your acceptance of the current terms and limits; activity is recorded per customer.

Disconnecting and deleting

• Disconnect Xero from Settings: the connection is revoked in Xero first, then the stored tokens are deleted. You can also remove Duewick from Xero’s connected apps.
• Cancel the subscription from Settings. Cancelling stops the agent straight away.
• Request account deletion from Settings: the agent stops and the subscription is cancelled immediately. We then review any records that must be kept before completing deletion, so data is not erased instantly.

Not available yet

• Multi-factor authentication for Duewick accounts.
• An independent security audit or certification (for example SOC 2 or ISO 27001).
• Fixed retention periods for every category of data.
• Sending from your own email domain, QuickBooks and Microsoft sign-in.

Report a problem

Email hello@duewick.com if you find a security issue or think your data has been handled incorrectly. Never send passwords or card details.