Architecture & Design

1. Executive Summary

XBert is a cloud-native SaaS platform that provides AI-powered automation, compliance monitoring, and data quality analysis for accounting firms and their clients. The platform integrates with leading accounting and payroll/HR systems (Xero, QuickBooks, MYOB, FreeAgent, Xero Practice Manager, Xero Payroll, Employment Hero) to deliver automated insights, exception detection, and workflow management.

The platform is built entirely on Microsoft Azure PaaS services, hosted within Australian data centres, and developed and maintained by XBert Pty Ltd employees located in Australia.

A more detailed architecture description — including database topology, instance counts, and operational escalation procedures — is available behind the Full Trust Centre. Request access if you need that level of depth for due diligence.

2. System Architecture Overview

                       ┌──────────────────────────┐
                       │       End Users          │
                       │  (Accounting firms &     │
                       │   their clients)         │
                       └────────────┬─────────────┘
                                    │  HTTPS / TLS 1.3
                                    ▼
                  ┌─────────────────┴─────────────────┐
                  │                                   │
                  ▼                                   ▼
        ┌──────────────────┐                ┌────────────────────┐
        │  Web & Mobile    │                │  Identity (Auth0)  │
        │  applications    │                │  OAuth 2.0 / JWT   │
        └────────┬─────────┘                └────────────────────┘
                 │
                 ▼
        ┌────────────────────┐
        │   Backend APIs     │
        │   & background     │
        │   processing       │
        └────────┬───────────┘
                 │
        ┌────────┴─────────────────┐
        ▼                          ▼
┌──────────────────┐      ┌────────────────────┐
│  Azure SQL,      │      │  AI / MCP / Memory │
│  Blob, Redis     │      │  services          │
│  (Australia)     │      │  (Australia)       │
└──────────────────┘      └────────────────────┘

3. Application Components

3.1 Web Application (Frontend)

Attribute	Detail
Technology	Angular, TypeScript
Hosting	Azure App Service
Purpose	Primary web interface for accounting firms and practice managers
Security	Auth0 SSO, role-based access, tenant isolation, security headers
Real-time	WebSocket for live notifications and updates

3.2 Backend APIs

Attribute	Detail
Technology	C#, ASP.NET Core
Hosting	Azure App Service
Authentication	JWT tokens issued by Auth0
Authorisation	Role-based access control with multi-tenant isolation
Real-time	Azure SignalR Service for WebSocket communication
API Documentation	Auto-generated Swagger / OpenAPI

3.3 Mobile Application

Attribute	Detail
Technology	React Native, TypeScript
Platforms	iOS, Android, web
Purpose	Client communication, document capture, and receipt management
Authentication	Auth0 OAuth 2.0

3.4 Background & Data Processing Services

Attribute	Detail
Technology	C#, .NET, Azure Functions
Purpose	Background job processing, accounting-data ingestion and transformation, alert generation, reporting
Architecture	Queue-based processing with Azure Service Bus

3.5 AI, MCP and Memory Services

Attribute	Detail
Technology	C#, .NET, Microsoft Agent Framework
AI Providers	OpenAI and Anthropic Claude, used under Data Processing Agreements (ephemeral processing, no training on customer data)
MCP Gateway	Single authenticated entry point through which AI agents access customer data via typed tools — see AI Governance & Data Processing
Memory (Mem0)	Hosted in Azure Container Apps within Australia

4. Data Architecture

4.1 Storage

All persistent customer data is held in Azure SQL Database and Azure Blob Storage, hosted in Australian Azure regions. Sub-systems are partitioned across multiple logical databases for separation of concerns (core application data, data warehouse, reporting, AI/intelligence state, billing) and to allow independent scaling and access control.

4.2 Multi-Tenancy Model

XBert uses a hierarchical multi-tenant architecture:

• Connect (Portal): Top-level entity representing an accounting practice
• Client Tenants: Child entities representing individual client businesses
• All data queries are automatically filtered by tenant at the ORM level (Entity Framework)
• Cross-tenant data access is prevented at the application and database layers

4.3 Data Classification

Classification	Examples	Protection
Confidential	Financial records, bank transactions, payroll data	Encrypted at rest (AES-256), in transit (TLS 1.3), tenant-isolated
Internal	User profiles, tenant configurations, audit logs	Encrypted, role-based access
Public	Marketing content, help documentation	Standard web hosting security

5. Infrastructure

5.1 Azure Services

XBert runs on Azure PaaS services hosted in Australia Southeast (primary) and Australia East (DR). The platform uses:

• Azure App Service (web applications and APIs)
• Azure Functions (background processing and data fabric)
• Azure SQL Database (relational data)
• Azure Cache for Redis (application caching and session)
• Azure SignalR Service (real-time WebSockets)
• Azure Container Apps (containerised services such as Mem0)
• Azure Blob Storage (document and log storage)
• Azure Key Vault (secrets, certificates, encryption keys)
• Azure Service Bus (async messaging)
• Azure Monitor, Application Insights, Microsoft Defender for Cloud (observability and security posture)

5.2 Region Strategy

• Primary: Australia Southeast (Melbourne)
• DR: Australia East (Sydney)
• All customer data remains within Australian Azure regions
• Database geo-replication configured between primary and DR

6. Security Controls

6.1 Authentication and Authorisation

User Login
    │
    ▼
┌─────────────────┐
│   Auth0 (Okta)  │  ◄── OAuth 2.0 / OIDC
│   Identity      │      MFA enforced
│   Provider      │      Brute-force protection
└────────┬────────┘      Anomaly detection
         │
    JWT Token (signed)
         │
         ▼
┌─────────────────┐
│   Backend API   │  ◄── Token validation
│                 │      Claims-based authorisation
│                 │      Tenant isolation filter
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   Azure SQL     │  ◄── Tenant-scoped data access
│                 │      Encrypted at rest (TDE)
└─────────────────┘      Audit logging enabled

6.2 Encryption

Layer	Standard
Data in transit (external)	TLS 1.3
Data in transit (internal)	TLS 1.2+
Data at rest (databases)	AES-256 (Azure SQL Transparent Data Encryption)
Data at rest (storage)	AES-256 (Azure Storage Service Encryption)
Secrets management	Azure Key Vault, HSM-backed where available

6.3 Access Controls

• Azure Entra ID: Cloud identity for administrative access with MFA and Conditional Access
• Role-Based Access Control (RBAC): Azure resource access based on job function
• Principle of Least Privilege across all accounts and service identities
• IP restrictions on administrative endpoints and database firewalls
• Key Vault access policies scoped to specific service identities

7. Network Architecture

XBert uses Azure Platform-as-a-Service exclusively. There are no virtual machines or operating systems to manage. Network security is provided by Azure platform controls: HTTPS enforcement, IP restrictions on administrative paths, SQL firewall rules, CORS policies, security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options), OWASP-rule WAF, and Azure DDoS Protection.

8. CI/CD and Deployment

Stage	Tool	Purpose
Source control	GitHub (private repositories)	Version control, code ownership
CI/CD orchestration	Azure DevOps + GitHub Actions	Build, test, deploy automation
Security scanning	OWASP tools, Dependabot	Static analysis, dependency vulnerabilities
Testing	xUnit, Karma/Jasmine, Playwright	Unit, integration, end-to-end tests
Deployment	Azure App Service deployment slots	Zero-downtime slot-swap releases

Production releases use zero-downtime slot swaps, with immediate rollback capability. All production changes flow through automated CI/CD pipelines — no manual deployments.

9. Monitoring and Alerting

XBert operates a layered monitoring stack across Azure Monitor, Application Insights, Microsoft Defender for Cloud, Sentry, and external uptime monitoring. Alerts are routed to the engineering team via real-time channels with defined response SLAs by severity. Operational escalation procedures, alert thresholds, and team channel details are documented in the Network Monitoring & Logging Policy (available behind the Full Trust Centre).

10. Business Continuity and Disaster Recovery

Metric	Target
Recovery Time Objective (RTO)	< 24 hours
Recovery Point Objective (RPO)	< 1 hour (database PITR)

• Azure SQL geo-replication provides continuous database replication between Australian regions
• Database backups: 28-day point-in-time recovery + 12-month long-term retention
• Source code stored in GitHub enables rapid redeployment
• Annual DR exercises with documented test results

11. Third-Party Integrations

XBert integrates with accounting and payroll systems (Xero, QuickBooks, MYOB, FreeAgent, Xero Payroll, Employment Hero, Xero Practice Manager) over OAuth 2.0 and HTTPS, and with AI providers (OpenAI, Anthropic) under Data Processing Agreements. Identity is provided by Auth0 (Okta); billing and payments are handled by Chargebee and Stripe (both PCI-DSS Level 1).

A full list of sub-processors is published on Sub-processors.

12. Compliance Alignment

XBert’s architecture and security controls align with:

Standard	Alignment
Privacy Act 1988 (Cth)	Australian data residency; privacy-by-design; NDB scheme compliance
Australian Privacy Principles	Data minimisation, purpose limitation, security safeguards
GDPR (where applicable)	Data Processing Agreements; breach notification; data subject rights
ISO 27001	Information security management practices aligned to Annex A controls
OWASP	Secure development lifecycle; Top 10 vulnerability prevention
Essential Eight	Application patching, MFA, application control alignment
PCI-DSS	No card data stored; compliant payment providers (Chargebee, Stripe)

13. Change History

Version	Date	Changes
1.1	2026-06-04	Public-grade summary; database topology, instance counts, and operational escalation moved behind Full Trust Centre
1.0	April 2026	Initial creation