No training on your data
xpnAi does not use your customer data to train AI models. Your financial information remains yours.
TRUST AND SECURITY
Your financial data.
Protected at every step.
xpnAi is a highly optimised MCP server that connects your financial data to your corporate-approved AI tools. Achieve exceptional efficiencies with the tools your organisation trusts, backed by audited security controls.
YOUR DATA. YOUR PERMISSION. YOUR CHOICE.
Your customer data is never used
by xpnAi for AI training.
No AI without your express permission
AI is not used inside xpnAi without your express permission. Even then, AI is only used inside xpnAi to locate accounts and contacts which are likely candidates for deferrals or intercompany loans (based on their names).
Use your corporate-approved tools
Connect the AI agents your organisation has approved through MCP. Bring your own tools and policies to automate finance tasks, investigate transactions and close faster.
SOC 2TYPE II
INDEPENDENTLY AUDITED
Controls that stand up over time.
xpnAi is covered by SOC 2 Type II audited controls, including access and change management, incident response, monitoring and data handling. The audit assesses how those controls operate over time.
Your data stays yours.
You retain ownership and intellectual property rights in your data. Removing an organisation also revokes its related access tokens.
Hosted in Australia.
xpnAi runs on Microsoft Azure, with data stored in Australian data centres.
Encrypted in transit and at rest.
Stored data uses AES-256 encryption. Connections between your browser and our servers are protected by HTTPS.
Backed up for recovery.
Encrypted backups are held in a secondary data centre. Backups can occur every 10 minutes, supporting recovery from another location.
YOU CONTROL ACCESS
The right people.
The right workspace.
Account and workspace security
Sign in to your xpnAi account to access your workspaces. Workspace Administrators manage invitations, membership and assistant connections. Subscription administration is separate from workspace access.
Assistant access is scoped
Each assistant connection is authorised by one person for one workspace. It does not grant access to all of that person’s workspaces, and switching workspaces in the browser does not change the assistant’s connection.
Write access is off by default
You must expressly enable writing back to Xero when creating an agent connection. Without that permission, the connection cannot change your Xero data.
Draft entries only. Posting stays with your team.
Even with write access enabled, xpnAi creates journals, bills and invoices only in a DRAFT state. xpnAi cannot approve or post these entries to Xero. Your team reviews and approves or posts them in Xero. Authorised changes to master data, such as contacts or accounts, update those records directly.
Revoke access when you need to
Revoke your assistant connections under Connections > MCP. Removing workspace membership also stops subsequent requests. Revocation does not remove files already downloaded, and existing export links remain available until they expire.
VULNERABILITY REPORTING
Help keep finance data safe.
Send suspected security vulnerabilities to our security team, including the affected service, reproduction steps and potential impact.
security@xpna.co