Does Xero collect your data or use it to train AI?
Table of Contents
No — Xero states the large language models behind JAX are not trained on your data (xero.com, retrieved 9 September 2026). But that promise sits on a product page, not in a contract: neither the Terms of Use, updated 3 August 2026, nor the Data Processing Addendum, dated 11 February 2025, contains a model-training clause. The gap is the story.
Two different questions are hiding in this one
Ask whether Xero collects your data and you are asking two questions with different answers.
Your data versus your clients’ data
Xero is the controller of your name, email and billing details. For the invoices, contacts and payroll records you enter about other people, you are the controller and Xero is your processor.
Which document covers which
Xero’s privacy notice, dated 11 February 2025, does not cover data subscribers enter about their customers, suppliers and employees. That sits under the addendum, and the two carry different promises.
What Xero says about AI and your data
Xero’s position is that customer data does not train the models behind its assistant.
The JAX answer
On Xero’s JAX page, retrieved 9 September 2026, Xero states that JAX chat does not use customer data to train the large language models it relies on. One answer there names Amazon Web Services, Microsoft Azure and Google Cloud Platform; a second answer on the same page adds OpenAI.
The Claude integration
Xero’s media release of 27 March 2026 announced an Anthropic partnership and states that proprietary business data is never used to train Claude’s models. A follow-up release reports it live from May 2026.
What Xero’s contracts actually say
None of the documents you accepted contains that sentence. Here is what each does.
| Document | What it says about AI and your data | Xero’s date | Captured |
|---|---|---|---|
| Terms of use, s19 | Licence to analyze your data to improve and develop services | 3 Aug 2026 | 9 Sep 2026 |
| Terms of use, s22 | May build anonymised aggregate data for its own purposes | 3 Aug 2026 | 9 Sep 2026 |
| Privacy notice, s5 | AI/ML listed under delivering and improving services | 11 Feb 2025 | 9 Sep 2026 |
| Data processing addendum | No model-training clause | 11 Feb 2025 | 9 Sep 2026 |
| JAX product page | Models not trained on your data | No date published | 9 Sep 2026 |
Sections 19 and 22
Section 19 of Xero’s terms of use is broader than the training question and is not limited by it. The no-training statement does not reach the derivatives section 22 permits, and the terms name no opt-out.
What the addendum covers, and what it doesn’t
The data processing addendum governs your clients’ data. We read the US-edition terms and addendum as published on 9 September 2026 and found no model-training clause in either, having not read the regional editions.
💵 Verified: Seven years’ post-termination data retention, per clause 1.10 of that addendum dated 11 February 2025, retrieved 9 September 2026 — part of what leaving Xero costs.
The 3 August 2026 update did not touch either clause: Xero’s archived February 2025 terms carry both in the same words, with no version listed between.
Which AI companies sit in the chain
Two AI companies appear on Xero’s own list of third parties processing your data.
Who is on the register
Xero’s subprocessor register, retrieved 9 September 2026, lists Anthropic and OpenAI, each described as providing conversational artificial intelligence services from the United States. It also names CloudFactory, Infosys and the Syft Analytics entities among Xero group affiliates — and who owns Xero now is a separate record.
What the register doesn’t tell you
The register carries no publication date, and Xero states it may change. The JAX training answer names three providers; the register names two AI companies that answer does not mention.
What you can actually do about it
One clause gives you a lever most subscribers never learn exists.
The 30-day notice and your 14-day window
Clause 1.6 of the addendum dated 11 February 2025 sets out the process:
- Xero gives at least 30 days’ notice of a subprocessor change by editing its register.
- You object on reasonable data-protection grounds within 14 days of that notice.
- If it cannot be resolved, Xero may decline the appointment, or either side may end the agreement on one month’s notice.
⚠️ This Costs You: The objection path ends in termination if neither side moves. Treat it as a documented right, not as leverage.
Limiting JAX access
Xero’s JAX page describes no off switch. Access follows the account, so how Xero’s user roles work is your control.
What would change this verdict
A model-training clause in the terms or addendum, or a dated Xero statement covering the section 22 derivatives.
✅ Do This: Check the subprocessor register monthly and keep the dated copy. The 14-day clock starts from an edit to that page.
Who should look harder before relying on this
Two groups need their own assessment, not this page.
Accountants and bookkeepers holding client data
Clause 1.3 puts the obligation on you to hold the rights and permissions for Xero to process what you enter. Xero states it is certified compliant with ISO/IEC 27001:2022 and audited against SOC 2, and provides that report on request. Get it; this page records what the documents say and is not professional advice.
Subscribers in the EEA and UK
The addendum incorporates the standard contractual clauses for restricted transfers, governed by Irish law. Xero (UK) Limited is the UK controller, Xero (NZ) Limited the EEA one.
🧾 Not Tested: We hold no Xero subscription, so nothing here describes JAX in a live account. Whether the product matches its documentation is outside what this page can show.
Frequently asked questions
1. Does Xero use your data to train AI?
Xero states JAX chat does not train its language models on your data, per its page captured 9 September 2026.
2. Does Xero sell your data?
Section 19 permits disclosure to third-party providers and partners. Xero’s terms, dated 3 August 2026, do not address selling.
3. Which AI companies are Xero subprocessors?
Xero’s subprocessor register listed Anthropic and OpenAI as conversational artificial intelligence providers when captured on 9 September 2026.
4. Does Xero’s privacy notice cover my clients’ data?
No. The privacy notice, dated 11 February 2025, excludes personal data subscribers enter about their customers, suppliers and employees.
5. Can I turn JAX off?
Xero’s JAX page describes no off switch. It runs when opened, and access follows your existing roles and permissions.
6. How do I object to a Xero subprocessor?
Object on data-protection grounds within 14 days of Xero’s notice, under clause 1.6 of the addendum dated 11 February 2025.
7. How long does Xero keep my data after I cancel?
Seven years after termination, under clause 1.10 of Xero’s addendum dated 11 February 2025, unless you request deletion.
8. Did the Claude integration change Xero’s data terms?
Sections 19 and 22 read identically in the February 2025 and 3 August 2026 versions of Xero’s terms.
The short version
Xero says its language models are not trained on your data, and says so clearly. That statement lives on a product page, not the contract you accepted.
The licence in section 19 is wider than the training question, and it did not change when the Claude integration arrived. If that moves you, price what a move to QuickBooks costs you next.
