Your numbers. Safely kept.

Read-only access

Corbi reads your reports. It never writes to Xero. The accounting permissions are:

• accounting.settings.read
• accounting.reports.profitandloss.read
• accounting.reports.balancesheet.read
• accounting.reports.trialbalance.read
• accounting.budgets.read

Sign-in permissions are openid, profile and email. The offline_access permission keeps the authorised connection available for nightly updates.

You can disconnect any time.

Encrypted, in Sydney

Your data is hosted in Sydney, Australia, and encrypted in transit and at rest. Xero access tokens are encrypted and never shown in the browser.

Your data does not train AI

No AI or machine learning is trained on your data. Corbi calculates forecasts using fixed rules, your actual figures and your budget.

If there is a breach

We tell affected customers and Xero promptly, as the law and Xero’s terms require.

Report a security issue

Email support@nivens.tech with “Corbi security” in the subject. Describe what you found and how we can contact you. Please leave passwords, access tokens and customer data out of your email.