Docs Category: Ramblings

The Hidden Cost of Xero’s Dynamic Contacts: Why Changing an Address Could Hurt Your Business

Xero’s approach to storing invoice contact information may seem like a minor technical detail, but it poses major risks to businesses. Why? When you update a customer’s or supplier’s name or address in Xero, that change isn’t limited to new invoices – it retroactively applies to all past invoices for that contact. In other words, Xero does not keep a snapshot of the original contact details on historical invoices. This longstanding quirk (often considered a “bug” by frustrated users) has been around since Xero’s early days and remains unresolved as of 2025. Why is this a big deal? Because an invoice is a legal record. If the details on that record can change after the fact, it undermines the integrity of your financial documents. In this post, we’ll explore: (1) the serious compliance, audit, and legal implications of Xero’s dynamic contact fields; (2) real examples of businesses impacted; (3) why Xero can’t easily fix this; and (4) how an independent backup solution like Control-C preserves immutable, original copies of your invoices to protect your business. Why Xero’s Dynamic Contact Data is a Serious Problem Xero’s design choice to link invoices to the live contact information (instead of storing the original name and address on the invoice) might sound technical, but it has real-world consequences. Here’s why business owners should be worried: In short, what should be static historical records in Xero are, in fact, dynamic. This poses compliance headaches, weakens audit reliability, creates legal ambiguity, and makes it impossible to reproduce documents as they were. For business owners who must attest that their records are complete and correct, this is a hidden ticking time bomb. Real-World Examples: Businesses Caught Off-Guard To illustrate how this issue plays out, let’s look at a few scenarios Xero users have actually experienced: In community forums and discussions, you can find many frustrated Xero users encountering these problems. Some call it a “bug”, others a design flaw – either way, it’s a source of pain. And notably, this isn’t new. Community members have been asking Xero to address it “for forever,” as one person put it. Posts from 2021, 2023, 2024, 2025 all echo the same theme: Why can’t Xero preserve original invoice details? The fact that savvy users recommend manual workarounds (like saving PDFs or re-entering info into invoices) is telling – it’s an acknowledgement that Xero itself isn’t doing the job of historical record-keeping in this respect. The timeline above illustrates how a seemingly innocent contact update can snowball into an audit headache – and how having an independent backup that stores original records can save the day. In the next sections, we’ll discuss why Xero hasn’t fixed this issue and how Control-C’s solution works in practice. Why Xero Can’t (or Won’t) Fix This Issue Retroactively It’s reasonable to wonder: Why doesn’t Xero just change how they handle invoices to avoid this problem? The truth comes down to a mix of technical design and data policy: In summary, Xero likely won’t fix this fundamental design issue in a way that covers past data. At best, they might improve future behaviour (there’s speculation that “new invoicing” might eventually handle contact details more statically, but evidence shows the problem still exists in 2025. Therefore, as a business owner or finance manager, you should take proactive steps knowing this limitation exists. Enter Control-C. How Control-C Solves the Problem: Immutable Backups of Your Xero Data While Xero cannot provide you an immutable record of your invoices’ original state, Control-C can. Control-C is a cloud backup service (and Xero-certified app partner) that specializes in protecting Xero data. We’ve been backing up Xero organizations for over a decade (since 2013), and one of the core principles of our service is immutability – once we back up a record, we never alter that snapshot. Here’s how Control-C addresses the specific invoice contact issue (and more): Given these capabilities, let’s directly compare how Xero vs. Control-C handle the preservation of invoice information: Aspect Xero’s Native System (Dynamic Data Model) Control-C Backup (Immutable Data Storage) Invoice Contact Details Not preserved statically. Invoices pull the current contact name/address from the contact record each time you view or print them. Past invoices will show updated contact info if the contact was edited1. There is no automatic snapshot of the original details at issuance. Fully preserved. Each invoice in the backup retains the exact contact name and address it had when the backup was taken (typically at issuance and on each change). Original details are saved and never overwritten, thanks to versioned, immutable snapshots. Historical Accuracy Potentially compromised. Xero cannot guarantee an invoice you look at today is an authentic record of what was originally sent. It reflects the “live” data. Old data may be lost unless you manually saved a copy. Xero’s audit log will note if an invoice was edited, but it does not keep the old contact info as a historical entry. This can lead to compliance issues, since you lack an unaltered archive of invoices. Guaranteed accuracy. Control-C’s backups act as a tamper-proof archive. We store every version of each invoice, so you can always retrieve an authentic copy. This provides a reliable audit trail. You’ll have the original invoice details even years later, satisfying record-keeping laws (e.g. 7-year retention rules3) and auditor expectations. Reissuing or Proof of Original Limited to none. Xero doesn’t offer a way to view or retrieve the original instance of an invoice after changes. You would have to rely on any PDF you saved at the time (or perhaps the emailed copy in your sent email). If you open an old invoice in Xero, you cannot roll it back to see old contact info. As a result, providing a customer or auditor with an exact original via Xero alone is impossible if changes occurred. Easy and exact. Control-C allows you to pull up the original invoice record on demand. Need to reissue an old invoice? Just find it in the backup (by date, number, etc.) and you can export it exactly as it was. This means you can confidently give stakeholders a copy knowing it matches the original. No more “sorry, our system updated the address” – you have the original on file. Audit Trail & Change

Read More »

ISO 27001 – the importance of backing up Xero.

ISO 27001, the international standard for information security management systems (ISMS), doesn’t specifically mandate a backup of financial records like Xero data. However, it emphasises the importance of protecting information assets against loss, damage, or unauthorised access.   Here’s how the standard indirectly necessitates backups for financial data like that found in Xero: Therefore, while ISO 27001 doesn’t explicitly mention Xero data, the requirements for protecting information assets, mitigating risks, and ensuring business continuity effectively necessitate the implementation of robust backup strategies for financial records like those stored in Xero. Backups ensure that even if the primary data is lost or compromised, a secondary copy is available for recovery, maintaining the confidentiality, integrity, and availability of this critical information.   For Xero users, this means that their accounting data should be backed up regularly and securely to comply with ISO 27001 and to protect their business interests. 5 Steps to an Effective ISO 27001 Risk Assessment – IT Governance www.itgovernance.eu

Read More »

Are you a ISO 27001 Certified Business

While I can’t give you an exact number or percentage, it’s highly probable that a significant portion of ISO 27001 certified businesses are users of Xero. Xero itself is ISO 27001 certified, demonstrating its commitment to information security. This makes it an attractive option for businesses seeking to maintain or achieve ISO 27001 compliance, as it helps them meet certain requirements related to information security management.   Furthermore, Xero is a widely used accounting software platform globally, catering to businesses of all sizes. Therefore, it’s logical to assume that there is significant overlap between the pool of ISO 27001 certified businesses and Xero users.   Should these Xero users that are ISO 27001 compliant be backing up their Xero data to stay compliant? Absolutely, ISO 27001 compliant Xero users should be backing up their Xero data to stay compliant. ISO 27001 is an international standard for information security management systems. A core principle of this standard is ensuring the availability of information, which includes having robust backup and recovery processes in place. Even though Xero itself may be ISO 27001 certified, it doesn’t absolve businesses from their own responsibility to protect their data.   By not backing up their Xero data, these businesses are exposing themselves to significant risks, such as: Therefore, it’s imperative for ISO 27001 compliant businesses to proactively implement a robust backup strategy for their Xero data. This ensures not only compliance but also business continuity and peace of mind. Would such a certified business lose their compliance certification if they did not backup Xero? An ISO 27001 certified business could potentially lose their certification if they fail to back up their Xero data. ISO 27001 emphasises the importance of information availability, which includes having adequate backup and recovery mechanisms in place. If an auditor discovers that a business lacks proper backups for critical data like that stored in Xero, it could be seen as a major non-conformance.   The severity of the non-conformance would depend on factors such as the extent of the data not being backed up, the potential impact on business operations, and the existence of any mitigating controls. However, the lack of Xero backups could very well lead to the suspension or revocation of the ISO 27001 certification. It’s important to remember that ISO 27001 compliance isn’t just about ticking boxes; it’s about implementing a robust information security management system that protects the confidentiality, integrity, and availability of data. Failing to back up Xero data undermines this fundamental principle and puts the business at risk of non-compliance.  

Read More »

Xero Partners Clearly Lack their own BCP

No XPM Backup? No BCP. It’s that simple. The Absence of a BCP Reveals a Deeper Problem: Not having a Business Continuity Plan (BCP) in place isn’t just about lacking a backup. It raises a glaring red flag that you haven’t even considered the very real possibility of disruption to your business. In a tightly regulated industry like accounting, this oversight is not only unfathomable, but it’s also downright irresponsible. Bad stuff happens. Black swan moments are real. Think back to the COVID lockdowns – who could have predicted that? Or the recent CrowdStrike incident that sent shockwaves through the digital world. And now, the Xero outage, leaving countless businesses paralysed due to their reliance on a third-party provider. These are real-life events that most hadn’t even considered. These incidents underscore a critical point: your practice’s survival isn’t guaranteed. A BCP isn’t just a document; it’s a meticulously crafted strategy that involves identifying critical processes, assessing risks, and developing detailed procedures to maintain operations during disruptions. Without a BCP, you lack tested runbooks, leaving you scrambling and improvising in a crisis. This can lead to costly delays, errors, and further damage to your business. Many underestimate the far-reaching impact of downtime. Beyond lost revenue, consider the damage to client relationships, employee morale, and your hard-earned reputation. The stark reality is: a non-existent BCP leaves your practice vulnerable and unprepared. It’s not a matter of if a disaster will happen, but when. Furthermore, not having a backup of your Xero data is a direct violation of Xero’s Terms of Use. This puts you in breach of contract, potentially jeopardizing your access to the platform and exposing you to legal liabilities. Where is your compliance auditor in all of this? Are they aware of this blatant disregard for the very foundation of your business operations? The stark reality is: a non-existent BCP leaves your practice vulnerable and unprepared. It’s not a matter of if a disaster will happen, but when. It’s a matter of business survival. Ignoring the need for a BCP is like neglecting to wear a seatbelt while driving. It’s a calculated risk that could have devastating consequences. A BCP is your safety harness, protecting your practice from the unexpected. The consequences could be devastating, both for your clients and your practice. It’s time to take your business’s resilience seriously and invest in a robust BCP. Your practice’s future depends on it. It’s time to take action. Protect your livelihood. Secure your practice’s future. A reliable backup solution like Control-C isn’t just an option; it’s a necessity. Don’t wait for disaster to strike. Implement Control-C today and ensure your firm’s data is safeguarded. Sincerely, The Control-C Team

Read More »

Xero Partners: Accountants ‘Duty of Care’

Xero Downtime & Local Tax Authority Compliance: Are You Fulfilling Your Duty of Care? Urgent Advisory: Introduction Recent outages have exposed a critical vulnerability for Xero users: a single point of failure due to the lack of in-built backup and the reliance on Xero holding the only copy of their data. This leaves your clients’ financial data exposed to loss, non-compliance, and business disruption. Key Points Every Accountant Needs to Know: Don’t Wait for Disaster to Strike As a trusted advisor, it’s your responsibility to ensure your clients understand these risks. Recommend a reliable Xero backup solution and guide them in creating a robust BCP in collaboration with their IT provider. Remember: Take action today to protect your clients and their businesses. #XeroBackup #TaxCompliance #BusinessContinuity #DataProtection #BCPBestPractice Protect Your Clients & Your Practice – Xero Data Backup & Local Tax Authority Compliance Dear Valued Accounting Professional, As a trusted Xero advisor, you play a vital role in your clients’ financial success. A critical aspect of this role is ensuring their data security, compliance with relevant regulations, and most importantly, their ability to maintain business continuity in the face of unexpected disruptions. We’re writing to you today to highlight the urgent matter of Xero data backups, Local Tax Authority requirements, and the absolute necessity of a robust Business Continuity Plan (BCP) in place. The Hidden Risk: Xero Data Backup Non-Compliance Many businesses unknowingly violate Xero’s Terms of Use by not maintaining a local backup of their financial data. This oversight can have serious consequences, including: Local Tax Authority Expectations & Your Professional Responsibility While the Local Tax Authority doesn’t explicitly mandate local Xero backups, they do require businesses to maintain complete and accessible financial records for a specified period, and the data must be kept locally, domiciled in the same jurisdiction as the business. This is crucial for: As an accountant and trusted advisor, you have a professional duty of care to inform your clients about these risks and obligations. By proactively addressing Xero data backup and Local Tax Authority compliance, you can: The Critical Link: Data Backup and Business Continuity A Business Continuity Plan (BCP) is essential for any business, regardless of size. However, a BCP is only as effective as the data it can rely on. Without a secure and accessible backup of your Xero data, your BCP is incomplete. Key Recommendation: Collaborate with IT Professionals While you play a crucial role in advising your clients on the importance of a BCP and data backup, their Managed Service Provider (MSP) or IT provider is best equipped to help them develop and implement a comprehensive plan. Take Action Now We urge you to prioritize this issue and take immediate action to ensure your clients are compliant with Xero’s Terms of Use, Local Tax Authority requirements, and have a solid BCP in place that includes a reliable data backup solution. This includes: By taking these proactive steps, you not only protect your clients and your firm but also demonstrate your commitment to ethical and responsible accounting practices and contribute to your clients’ long-term success and resilience. We hope this information is helpful and encourage you to reach out if you have any questions or concerns.

Read More »

Most Popular:

We would love to hear from you

Request for Info or to be contacted

Offices

Pacific - New Zealand

Asia - Philippines

Europe - France

main phone

+(64) 9 520 6397