Due Diligence FAQ
This page addresses common questions raised during enterprise security assessments and due diligence reviews. If your question is not covered here, please contact security@xbert.io.
1. General
Section titled “1. General”How long has XBert been in business?
Section titled “How long has XBert been in business?”XBert has been operating since 2019, delivering AI-driven workflow automation to accounting professionals. We operate across Australia, New Zealand, the United Kingdom, South Africa, and Canada.
Who owns and maintains the source code?
Section titled “Who owns and maintains the source code?”All source code is owned and maintained solely by XBert Pty Ltd. Code is stored in private GitHub repositories and has never been shared with any third party.
Do you use third-party contractors for development?
Section titled “Do you use third-party contractors for development?”No. All development is performed by XBert employees located in Australia, engaged under New South Wales law contracts. No offshore or contracted development resources are used.
2. Identity and Access Management
Section titled “2. Identity and Access Management”How are user identities managed?
Section titled “How are user identities managed?”User identity and authentication is managed through Auth0, which holds ISO 27001, SOC 2 Type II, and PCI DSS certifications. Authentication uses OAuth 2.0, with support for single sign-on via Xero, QuickBooks, FreeAgent, and Google accounts. Enterprise customers can also integrate via SAML 2.0 or OpenID Connect (OIDC) for organisational SSO.
Is multi-factor authentication enforced?
Section titled “Is multi-factor authentication enforced?”Yes. MFA is enforced on all internal systems, including Azure cloud access and all staff applications. MFA is also available for customer accounts.
How is privileged access managed?
Section titled “How is privileged access managed?”Privileged access is managed through Azure Entra ID with role-based access control (RBAC), IP restrictions, and Conditional Access policies. Privileged accounts are reviewed quarterly, and the principle of least privilege is enforced across all systems.
3. Data and Encryption
Section titled “3. Data and Encryption”Where is data stored?
Section titled “Where is data stored?”All customer data is stored in Microsoft Azure data centres located in Australia. The primary region is Australia Southeast, with disaster recovery in Australia East. All data remains within Australian zones.
Is data encrypted at rest and in transit?
Section titled “Is data encrypted at rest and in transit?”Yes. Data at rest is protected with AES-256 Transparent Data Encryption (TDE) for databases and Server-Side Encryption (SSE) for storage services. Data in transit uses TLS 1.3 for external-facing traffic and TLS 1.2 or later for internal service communication.
Who owns the data?
Section titled “Who owns the data?”Customers retain full ownership of all their data at all times. Self-service tools are provided for data export and deletion.
4. Artificial Intelligence
Section titled “4. Artificial Intelligence”Is customer data used for AI model training?
Section titled “Is customer data used for AI model training?”No. AI processing data is ephemeral and is not stored by AI providers under our Data Processing Agreements. Customer data is never used for model training by XBert or any third-party AI provider.
Where does AI processing occur?
Section titled “Where does AI processing occur?”AI inference requests may flow to US-based API endpoints operated by OpenAI and Anthropic. Data is not persisted at these endpoints and returns to Australian-hosted systems for storage and display. The XBert AI memory service is hosted entirely within Australia.
5. Security
Section titled “5. Security”Do you conduct penetration testing?
Section titled “Do you conduct penetration testing?”Yes. External penetration testing is conducted annually by independent assessors. Findings are risk-assessed, prioritised, and tracked through to remediation.
What is your breach notification timeframe?
Section titled “What is your breach notification timeframe?”Customer administrators are notified via email within 24 hours of a confirmed data breach. The Office of the Australian Information Commissioner (OAIC) is notified in accordance with the Notifiable Data Breaches scheme requirements.
What are your recovery objectives?
Section titled “What are your recovery objectives?”XBert maintains defined recovery objectives as part of our business continuity planning:
- Recovery Time Objective (RTO): Less than 24 hours
- Recovery Point Objective (RPO): Less than 1 hour, supported by database point-in-time recovery (PITR)
- Backup retention: 28 days
6. Development Practices
Section titled “6. Development Practices”How are code changes managed?
Section titled “How are code changes managed?”All code changes follow a controlled process:
- Changes are submitted via GitHub Pull Requests with mandatory peer review.
- An automated CI/CD pipeline runs build, security scanning, and test steps on every change.
- Production deployments use deployment slots to enable zero-downtime releases and safe rollback.
How often do you deploy to production?
Section titled “How often do you deploy to production?”XBert uses continuous deployment via CI/CD. Multiple deployments are made to production each week, with each release going through the full automated pipeline before reaching customers.