Xero Security for Accountants: MFA and Access

Xero security combines encrypted storage and independent audits with MFA and user permissions. Your practice must give each person their own login and remove access when their work ends.

How Xero Protects Client Data

Xero encrypts information when it is transferred and stored. Its security program also includes independently audited systems and account-level protections. Your practice controls who receives access and what those people can do.

Xero’s security page publishes ISO/IEC 27001:2022 certification and SOC 2 assurance reports. ISO 27001 concerns the organisation’s information-security management system. A SOC 2 report describes an independent examination of the accounting system’s safeguards.

Xero also publishes PCI DSS compliance for payment-card handling. That concerns card security. It does not establish that a staff member has the right permissions for every client file.

You can request the certificate and SOC 2 report from Xero for a supplier assessment. Read the report’s scope and exceptions alongside your practice’s requirements. A certification does not guarantee that an account cannot be compromised.

Your side of the arrangement starts with individual logins, MFA and limited access. Keep recovery email accounts protected as well. Someone who can recover a staff member’s account can threaten the client files that person can access.

Has Xero Been Hacked?

Xero customer accounts have been compromised through phishing and malware. A customer-account takeover is different from an intrusion into Xero’s underlying platform. Establish which event a report describes before answering a client’s question about a Xero data breach.

Reported Events and Their Meaning

The 2015 account comes from Xero’s statement to PYMNTS. The fake invitations appear on Xero’s security noticeboard. Xero’s login-outage explanation describes the separate availability failure.

For a worried client, explain the reported event and whether their organisation has evidence of unauthorised access. Then describe the checks you have completed. Avoid promising that Xero has never been breached or that their particular file is unaffected without checking it.

If a staff member entered credentials into a suspicious page, treat it as an account incident. Secure the affected device and email account, reset the password through Xero’s genuine site and contact Xero support. Review access and changed transactions before reassuring clients.

Multi-Factor Authentication in Xero

Multi-factor authentication (MFA) requires an additional sign-in check beyond the password. Xero requires MFA for users accessing paid accounting subscriptions. Your practice’s job is to complete setup for every staff login and protect each person’s recovery method.

Xero Verify supports approval through a push notification. Other supported authenticator apps generate a code to enter when signing in. Each staff member needs their own setup, even when several people work in the same client organisation.

Xero’s MFA guidance explains the account setup. Use this checklist when adding someone to the practice:

1. Invite the person using their own email address. Have them open Xero directly and accept the expected invitation.
2. In their account, open their initials or profile image, then Account. Select Set up beside Multi-factor authentication and complete the authenticator pairing.
3. Set a recovery method. Xero supports a backup email address or security questions for authenticator-based MFA. Protect the backup email account with its own strong password and MFA.
4. Test sign-in in a fresh browser session. The user must complete the authentication check and reach only the organisations assigned to them. Record completion without collecting their password or recovery answers.

Approve a push notification only when you have just started the matching login. An unexpected approval request requires investigation. A staff member must never approve a prompt because someone claiming to provide support asks them to.

Passkeys are also available through the Xero Me setup route for eligible users. That route starts in the Xero Me mobile app. An enrolled passkey can then authenticate web access.

If a phone is lost, use the registered recovery method to regain access and connect the replacement device. Xero’s MFA troubleshooting guide explains recovery and support escalation. Avoid creating a shared staff login to work around the lockout.

User Roles and Permissions

Xero user permissions determine what a person can see and change inside each client organisation. Practice access and client-organisation access are separate reviews. A staff member’s job title does not automatically establish the access they need.

Xero’s permissions update renames Advisor to Administrator and Read Only to Viewer in Business Edition. Standard retains its name. Existing users keep their access until someone changes it. Partner Edition permissions remain unchanged.

Match the Role to the Work

The Xero role matrix explains the renamed roles and additional permissions. Use the options in the client’s edition rather than copying an old Advisor-role checklist.

Review a Role Change or Departure

1. List the person’s practice permissions and every client organisation they can access. Include direct client invitations, which can exist alongside practice-managed access.
2. For someone changing duties, remove permissions their new work no longer needs. In the organisation, open Settings, then Users, and manage that person’s permissions. Save the changes.
3. For someone leaving, remove their practice access and their access to client organisations at the agreed time. Cancel outstanding invitations and transfer responsibility for jobs before access ends.
4. Review connected applications the person authorised. Assign an ongoing owner and reconnect or revoke them where needed. Removing the staff member is not a substitute for reviewing each connection.
5. Reopen the staff and organisation user lists. Confirm the intended permissions remain and the departing person has no authorised access. Keep a record of who made the changes.

Xero’s practice-permission guide distinguishes client-record access from staff-management permissions. Use that distinction when reviewing Xero Partner Hub + Practice Management as well as the individual accounting organisations.

For example, a bookkeeper moving off payroll can retain the transaction access needed for their remaining work. Remove payroll access separately and confirm the saved permissions. Keep the account only while the person still has an authorised role in the practice.