Draft for Ciaran's read, not published

Learn

Can I trust AI with my books?

Owners ask me this constantly, and I understand why: your books hold your customers, your payroll, your margins, essentially your whole business in one file. "AI" sounds like handing that to a black box. But "can I trust AI" is not actually one question. It is four small, boring, checkable ones, and once you split them the fear turns into a shopping checklist you can use on any tool, including ours.

The four questions to ask any AI tool before it touches your Xero

• 1. Can it change my books, or only read them? Xero connections come with scopes, and Xero shows them on the consent screen when you connect an app. A tool that only needs to read your numbers should only ask to read. If something wants write access it cannot justify in one sentence, stop there. Read-only means the worst realistic outcome is disclosure, never a corrupted ledger.
• 2. What does it store, and for how long? There is a large difference between a tool that keeps a synced copy of your ledger and one that reads what it needs, produces its output and discards the rest. Ask which one you are buying.
• 3. Is my data used to train AI models? This is the question people mean when they say "trust", and it deserves a yes-or-no answer in writing, not a link to a forty-page policy. Your sales ledger should never become anyone's training set.
• 4. Where does the processing happen? Which cloud, which country, which subprocessors. For a UK business under UK GDPR, "UK region" is a much shorter conversation than "wherever is cheapest today".

And one that costs nothing: check you can disconnect instantly. Xero's connected apps page lets you revoke any app's access yourself, at any time, without asking the vendor's permission. Whatever you connect, you stay in control of the connection.

How Own Your Numbers answers the four

Since this page will be read as a vendor talking, here are our answers in the same order, stated so you can hold us to them.

• Write access: none. Read-only by design. It cannot create, edit, approve, delete, reconcile or post anything in your Xero, ever. There is no write-back of any kind.
• Storage: read on demand, then discarded. Your Xero data is read when your briefing is built, used to build it, then discarded. We do not keep a synced copy of your ledger.
• Training: never. Your data is never used to train, fine-tune or improve any AI model. Not ours, not anyone's.
• Where: Google Cloud, UK region. The plain-English analysis runs on Vertex AI Enterprise in Google Cloud's UK region, as inference only.

What the AI actually does in a briefing, and what it is not allowed to do

Worth being precise, because "AI reads your books" conjures a model improvising your numbers. That is not how a Weekly Cash Score works. Your cash, net cash, cushion in months and risk rating are calculated, deterministically, from your ledger data; the formula is public and the same inputs always give the same answer. What the AI writes is the plain-English explanation around those calculated numbers, and it is constrained to explain them, not to invent its own. If the numbers cannot be trusted on a given week, the honest behaviour is to say so rather than guess; trust in the numbers is the entire product, so that is the design rule everything else obeys.

For accountants and bookkeepers: the same questions, on behalf of clients

If it is client data, the four questions stop being preferences and become duties: confidentiality to the client, UK GDPR obligations, and your professional body's expectations all sit on top. The practical sequence practices use: run the tool on your own practice's Xero first, so nothing client-side is exposed while you evaluate it; get the vendor's four answers in writing, including subprocessors and region; and connect clients with their agreement, under the read-only principle, so no third party ever holds write access to a client ledger. The scope question matters double here, because "read-only" is also what makes the client conversation easy: you can offer a weekly cash briefing per client while truthfully saying nobody new can touch their books.

When the answer is no

Do not connect anything, ours included, if the vendor cannot answer the four questions in plain English, if the requested scopes exceed the stated job, or if "do you train on my data" gets a paragraph instead of a no. There are real cases where the right answer is no tool at all. But notice what the four questions did: they moved the decision from "do I trust AI" to "does this specific tool, with these specific scopes, meet this specific bar". That is a decision an owner can actually make.