Security

Workspaces are isolated by authenticated user id. Integration refresh tokens are encrypted at rest. Dashboard routes require a session. Cron ingest uses a shared secret.

We request the minimum accounting scopes needed for open AR: contacts/customers, invoices, payments, and (on Xero) aged receivables. We do not request Xero accounting.transactions.

Incidents affecting ingest or send: email hello@revcollect.ai. We will tell affected workspaces what failed and how to reconnect.