It is one of the most common — and most dangerous — assumptions in business: "It is in the cloud, so it is backed up." Xero is robust, but platform resilience and your personal recoverability are two different things. Here is the distinction that matters.
- Xero protects its platform from infrastructure failure; it does not guarantee to restore data you delete or lose.
- A staff error, a compromised login, or a cancelled subscription can all permanently lose your records.
- This split is known as the shared responsibility model, and it applies to virtually every SaaS product.
- An independent daily backup closes the gap and satisfies record-keeping and audit obligations.
What Xero does protect
Xero runs serious infrastructure — redundant data centres, replication and platform-level disaster recovery. If a server fails, the platform fails over and you would likely never notice. That keeps the service available. What it does not do is protect you from things that happen inside your own account.
What it does not
Read Xero's terms and you will find backup of your own data framed as your responsibility. Consider the everyday ways records are lost that platform redundancy does nothing for:
- A staff member bulk-deletes or incorrectly edits transactions.
- A departing contractor or disgruntled user purges data before leaving.
- A phished or credential-stuffed login is used to alter or destroy records.
- A subscription lapses or is cancelled and data ages out.
- A faulty third-party integration writes bad data across your file.
In every one of these cases the platform did exactly what it promised. The loss still happened, and recovering it is on you.
The shared responsibility model
This split has a name: the shared responsibility model. The provider secures and runs the platform; the customer is responsible for their data, their users and their access. It is standard across Microsoft 365, Google Workspace, Salesforce and Xero alike. The mistake is assuming the provider's half covers yours.
Platform uptime is not the same as your ability to recover your own data.
Why it matters beyond convenience
Australian businesses must keep financial records for at least five years under ATO rules, and the Essential Eight treats regular, tested backups as a core control. If your only copy lives in a system you do not fully control, you have neither. An independent backup is what makes your records genuinely yours.
Closing the gap
The fix is straightforward: an automated, independent copy of your Xero data, taken daily, encrypted, retained for years, and restorable to any point in time. That is precisely what CINDA does — using a read-only connection that can never alter your books.