How we protect your data.

Signing in

Accounts use email and password sign-in through our authentication provider, Supabase. Passwords are stored by that provider as one-way hashes — RESERVD never sees or stores your password in readable form. New accounts confirm their email address before signing in, and passwords can be reset by email.

Connecting Xero

You connect Xero through Xero’s own sign-in page using OAuth 2.0. RESERVD never sees your Xero password. Each connection attempt uses a single-use security code to make sure the response comes back to the person who started it.

The access tokens Xero issues are encrypted (AES-256-GCM) with a key held only on our servers, and are never sent to your browser. When you disconnect, RESERVD removes its connection at Xero and destroys its stored tokens.

RESERVD reads your payments, invoices, bank transactions, contacts and profit and loss and balance sheet reports. The only thing it creates in Xero is a draft quote — and only when you ask it to. RESERVD never moves money or sends anything to your customers.

Your business, isolated

Every business’s data is separated at the database level with row-level security, so one business can never read another’s. Each business connects exactly one Xero organisation, and an organisation already connected to one business can’t be connected to another.

Server-side secrets

Keys for Xero, our AI provider and other services live only in our server environment. They are never included in the website or app code that runs in your browser.

In transit and at rest

All traffic to RESERVD and its services uses HTTPS. Your RESERVD data is stored in a managed Postgres database hosted in Sydney, Australia.

An audit trail you can rely on

When a payment is confirmed, the way RESERVD split it is recorded once and kept as history — later changes to your settings never silently rewrite past results. If Xero later deletes a payment, it stays visible and clearly marked rather than disappearing.

Access

Access to a business in RESERVD is limited to the people added to that business. Administrative access to RESERVD’s production systems is limited to the small team that runs the service.

Payments

Paid plans aren’t live yet. When they are, card payments will be handled by a dedicated payment provider; RESERVD will not store your card details.

What we don’t claim

RESERVD is an early-access product. We don’t currently hold formal security certifications such as ISO 27001 or SOC 2, and we won’t claim them until we do.

Reporting a security concern

If you think you’ve found a security issue, please contact us and choose “Security concern”. We’ll respond as quickly as we can.