Trust
Security
The facts below describe the platform as built. They are the same facts given to Xero in its annual security assessment.
Hosting
Microsoft Azure, region Australia East: Azure Container Apps for the application and Azure Database for PostgreSQL for data. Documents are held in Azure Blob Storage in the same region.
In transit
TLS 1.2 or higher on every connection. HTTPS only. The database connection requires SSL.
At rest
Azure encrypts the database and blob storage at rest. Xero refresh tokens are additionally encrypted in the application with AES-256-GCM; the key is held in Azure Key Vault, separately from the data, and never appears in code or on a command line.
Sign-in
Microsoft work accounts (Entra ID, any organisation) or a password with authenticator-app MFA. A business can require MFA for every password user. Failed sign-ins are rate limited. Sessions expire after seven days.
Isolation
Every record carries the business it belongs to, and PostgreSQL row-level security enforces that boundary at the database, not only in the application.
Roles and permissions
Owner, admin, office, yard, driver and read-only roles, with a per-user permission matrix beneath them. Only owners and admins can connect or change Xero organisations.
What leaves the platform
Uploaded documents are sent to Anthropic to be read. Xero ledger data is never sent to any model, and nothing is used to train one. Email is sent and received through Mailgun. No other third party receives data.
Audit
Money movements are recorded in append-only tables. Sign-offs record the person, the time and the balance agreed.
Reporting a vulnerability
Email security@instillcore.com.au. We acknowledge within one working day.
Source of truth: hire-platform/docs/08_Security_Facts.md. Update there first.