Privacy

Avaro Core is business software sold to firms. That puts us in two distinct positions, and your rights depend on which one applies to you.

For the people who hold an Avaro Core account — the staff of a customer firm — we decide how their account data is handled, so we are the controller. That covers names, email addresses, sign-in records and the audit trail of what they did in the product.

For the records a customer keeps in Avaro Core — their clients, contacts, deals, projects and invoices — the customer decides what to collect and why. They are the controller; we are their processor, and we act on their instructions. If you are a contact in a firm’s Avaro Core account and want your data changed or removed, ask that firm. We will help them do it, but the decision is theirs, not ours.

A customer can connect their Xero organisation so that invoices raised in Avaro Core appear in their accounts. The connection is optional, it is made by the customer, and nothing below happens unless they make it.

What we ask Xero for

Four permissions, and no more. Each is one an invoice cannot be created without, so each is defensible on the consent screen Xero shows before you approve anything:

• openid — to complete the sign-in to Xero.
• offline_access — so the connection survives longer than half an hour.
• accounting.invoices — to create the invoice.
• accounting.contacts — because creating an invoice has to match or create the contact it is addressed to.

What we send to Xero

Only what an invoice is made of: the contact’s name and email address, our invoice number as a reference, the currency, the issue and due dates, and for each line its description, quantity and unit price.

What we read back

Which Xero organisations the connection covers, so the right one can be chosen rather than guessed; and the identifier and number Xero assigns to each invoice we create, so the two systems can be reconciled.

What we never do

We do not read a customer’s accounts, bank feeds, payroll, reports or existing invoices. We do not change or delete anything already in their Xero. An invoice is handed over once and then belongs to Xero.

What we keep, and for how long

A Xero refresh token, encrypted with AES-256-GCM; the identifier and name of the connected Xero organisation; and, against each invoice we sent, the identifier and number Xero returned. The token is held for as long as the connection exists and is destroyed when it is disconnected or when the account is closed.

We use a small number of suppliers, and this is all of them. Each is bound by its own contract to process data only as instructed.

The database and uploaded files are in the United Kingdom, in the London region. Email is the exception: sending a message means handing it to our email supplier, which may process it outside the UK under standard contractual clauses.

Customer records are kept for as long as the customer keeps them and their account is open. Closing an account removes the organisation and everything attached to it.

The audit trail is the exception, and we would rather say so than leave it implied. It is append-only by design: an entry is never deleted, and each is cryptographically chained to the one before so that tampering is detectable. That is what makes it worth having, and we retain it for the life of the account as a matter of legitimate interest in keeping a trustworthy record of who did what. It holds identifiers, actions, timestamps and IP addresses — not the contents of the records themselves.

An erasure request can still reach it. Where an entry holds a personal detail — a name or an address inside the record of what changed — that detail can be removed without the entry itself being deleted and without the chain being re-linked: what happened, who did it and when all remain, and every link either side stays exactly as it was. The removal is itself recorded in the trail, with the reason, so a redacted entry is visibly a redacted entry rather than a gap. Some entries are refused, and we will say which and why: a signature on a contract is evidence the signatory created in order to be durable, and keeping it is part of performing the contract.

We do not currently operate an automated retention schedule that deletes older data on a timetable. We would rather state that plainly than imply a policy we do not yet run.

• Everything in transit is encrypted with TLS, and the site is served over HTTPS only.
• The database is encrypted at rest by the hosting provider.
• Sensitive secrets — two-factor seeds and integration tokens — are additionally encrypted with AES-256-GCM using a key held separately from the database.
• Each customer's data is isolated at the database level by row-level security, so a query carrying no organisation context returns nothing rather than everything.
• Passwords are hashed with bcrypt and are never stored or transmitted in readable form.
• Two-factor authentication and passkeys are available, and a firm can require a second factor across its whole account.
• The audit trail is hash-chained and verified on a schedule, so an alteration is detected rather than assumed impossible.
• A Content-Security-Policy restricts what the application is permitted to load or contact.

No system is perfectly secure, and we would not claim otherwise. What we do claim is written above, and each item is something the software actually does today.

One cookie, and it is strictly necessary: a session cookie that keeps you signed in. It is marked HttpOnly so no script can read it, SameSite so it is not sent from other sites, and Secure so it travels only over HTTPS. It is removed when you sign out.

There are no analytics cookies, no advertising cookies, no tracking pixels and no third-party scripts. That is why there is no cookie banner: there is nothing to consent to.

Under UK data protection law you may ask for a copy of your personal data, ask for it to be corrected or erased, ask us to restrict or stop processing it, and ask for it in a portable form. You will not be charged, and we will respond within one month.

Write to security@avarotechnologies.com. If you are a contact held in a customer firm’s account rather than an account holder yourself, please ask that firm first — they decide what happens to their records, and we will support them in acting on your request.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

If you have found a vulnerability, please tell us at security@avarotechnologies.com. We will acknowledge it, keep you informed, and will not pursue anyone who reports a genuine issue in good faith. Machine-readable details are at /.well-known/security.txt.

If this policy changes in a way that affects how personal data is handled, we will update the date at the top and tell account holders by email. We will not make a material change quietly.

Avaro Technologies Ltd — registered in England and Wales (company number 17073861)
Registered office: C/O Wainwrights Accountants, Faversham House, Old Hall Road, Bromborough, Wirral, United Kingdom, CH62 3NX
Registered with the Information Commissioner’s Office, reference ZC103328
security@avarotechnologies.com