Xero
What Xero publishes, measured on their own site. Every result below links the page we found it on, or lists the addresses we checked.
- 42out of 100
- 9/10Criteria measured
- 2026-08-31Checked
Vendor site: xero.com · category: Accounting
Data processing agreement
No data processing agreement found.
Checked 8 addresses on 2026-08-31.
Show the 8 addresses we checked
https://xero.com/legal/dpa– reached, no match (HTTP 404)https://xero.com/dpa– reached, no match (HTTP 404)https://xero.com/legal/data-processing-agreement– reached, no match (HTTP 404)https://xero.com/data-processing-agreement– reached, no match (HTTP 404)https://xero.com/legal/data-processing-addendum– reached, no match (HTTP 404)https://xero.com/legal/gdpr– reached, no match (HTTP 404)https://xero.com/trust/dpa– reached, no match (HTTP 404)https://xero.com/privacy/dpa– reached, no match (HTTP 404)
Subprocessor list
No subprocessor list found.
Checked 7 addresses on 2026-08-31.
Show the 7 addresses we checked
https://xero.com/legal/subprocessors– reached, no match (HTTP 404)https://xero.com/subprocessors– reached, no match (HTTP 404)https://xero.com/sub-processors– reached, no match (HTTP 404)https://xero.com/legal/sub-processors– reached, no match (HTTP 404)https://xero.com/trust/subprocessors– reached, no match (HTTP 404)https://xero.com/privacy/subprocessors– reached, no match (HTTP 404)https://xero.com/legal/subprocessor-list– reached, no match (HTTP 404)
Data location stated
The hosting location is stated on a public page.
Source: https://www.xero.com/legal/privacy/ · checked 2026-08-31
Status page with history
A public status page with incident history.
Source: https://status.xero.com/ · checked 2026-08-31
Public pricing
Actual numbers on a public page.
Source: https://www.xero.com/pricing-plans/ · checked 2026-08-31
Certifications named
SOC 2 or ISO 27001 named on a public page.
Source: https://www.xero.com/security/ · checked 2026-08-31
Uptime SLA with a figure
No uptime figure found.
Checked 6 addresses on 2026-08-31.
Show the 6 addresses we checked
https://xero.com/legal/sla– reached, no match (HTTP 404)https://xero.com/sla– reached, no match (HTTP 404)https://xero.com/legal/service-level-agreement– reached, no match (HTTP 404)https://xero.com/trust/sla– reached, no match (HTTP 404)https://xero.com/uptime– reached, no match (HTTP 404)https://xero.com/legal/uptime-sla– reached, no match (HTTP 404)
HTTPS enforced with HSTS
No enforced HTTPS with HSTS found.
Checked 2 addresses on 2026-08-31.
Show the 2 addresses we checked
http://xero.com/– redirects to https://xero.com/https://xero.com/– no HSTS header
No third-party tracking before consent
No consent-free first load found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://xero.com/– third-party requests before any interaction: api.schemaapp.com, cdn-au.onetrust.com, cdn.schemaapp.com, data.schemaapp.com, geolocation.onetrust.com, js-agent.newrelic.com, js.stripe.com, jscloud.net, m.stripe.network, www.googletagmanager.com
security.txt (RFC 9116)
Not measured. The vendor’s server blocked or rate-limited our crawler, so this was not measured.
Show the 1 address we checked
https://xero.com/.well-known/security.txt– blocked or unavailable (HTTP 403)