Why Ziroo backups stay readable without Ziroo

The Ziroo feature I'm proudest of is one we refused to build: there is no portal where you view your backups. No vault, no viewer, no "log in to browse your archive." Ziroo delivers plain PDF and CSV files into your inbox and your own cloud storage every morning, and then it gets out of the way. If you never log into Ziroo again, your archive doesn't care.

That was a deliberate decision, and it's commercially the wrong one, which is exactly why I want to explain it.

A backup you can't read without the vendor is a second subscription

Follow the logic of why anyone backs up cloud accounting in the first place. Your records live inside Xero, and your access to them depends on a subscription staying paid, a platform staying up, and a login staying yours. Xero's own terms are honest about the consequences: cancel and your data is archived out of reach; lose data and the remedy is a best-efforts recovery attempt. So you keep copies. Sensible.

Now look at how most backup products work. They pull your data into their platform, store it in their format, and show it to you through their interface. The day you stop paying them, you're exactly where you'd be the day you stopped paying Xero: records exist, somewhere, readable by someone who isn't you.

That's not a backup. That's a second subscription with the same failure mode as the first, sold as protection from it. You haven't removed the dependency; you've bought a spare copy of it.

Why the industry builds it that way anyway

Not villainy, mostly incentives. A vault you must log into produces engagement metrics, upsell surfaces, and beautiful retention numbers, because leaving means abandoning your history. Proprietary formats also make certain features easier to build; point-in-time restore into the accounting platform genuinely benefits from a database rather than a folder of PDFs.

But it's worth saying the unwritten part out loud: when your archive is only readable through a vendor, the archive is the retention strategy. Nobody puts "your data is the hostage" on a pricing page, and plenty of pricing pages depend on it.

What we chose instead, and what it costs us

Ziroo's entire product is delivery. Read-only connection to Xero, and every morning the previous day's invoices, quotes, and purchase orders arrive as individual PDFs with a CSV manifest, in your storage: your Google Drive, your Dropbox, your OneDrive, your inbox. Formats that will open on any machine in 2040. Our involvement with each file ends the moment it lands.

The inbox delivery gets questioned sometimes ("email, really?"), and I defend it every time. Email is the oldest widely-deployed archive format there is: distributed across providers, searchable, retained for years by default, and readable on everything ever made. When some future misconfiguration breaks a cloud storage connection nobody noticed, the morning emails are still there, doing their unglamorous job. Redundancy should be boring.

There are also features we declined on principle. Restore-back-into-Xero is the big one; building it well genuinely requires holding your data in our own structured store, which is precisely the custody we set out not to have. Other products make that trade honestly and some customers should pick them for it. We picked the other side: we'd rather be the copy that can't be taken from you than the wizard that puts things back.

The commercial cost is real and I did the sums on it. Our customers can leave with zero friction, because everything Ziroo ever delivered already lives with them. There's no archive to hold over anyone, no "reactivate to access your history," no engagement funnel. Our retention strategy is reduced to one uncomfortable sentence: the service has to keep being worth $15 a month, every month, forever.

Harder business. Better product. I can live with that trade.

The test every feature has to pass

Ziroo exists because of an afternoon when Xero was down and customers were standing at my counter, waiting on paperwork a platform wouldn't let me reach. The product was built for the moments when platforms fail you: outages, lapsed cards, cancelled subscriptions, disputes, vendors having a bad year.

Which forces an awkward question we ask about everything we build: what happens in the moment Ziroo fails you? If Ziroo went down, got acquired and ruined, or simply disappeared, every file already delivered keeps working, because none of them ever needed us to be readable. A backup company whose own disappearance would strand your records has failed its only design brief. We refuse to be a single point of failure for people who came to us to remove one.

If you're evaluating any backup tool, ours included, ask the vendor that one question: can I read yesterday's backup with your service switched off? Everything about how they've built their product is in the answer.

What this means if you use Ziroo

Practically: you can cancel any time and lose nothing already delivered. Your accountant can read the archive without a login to anything. Your records will outlive us, and we consider that a feature we shipped, not a risk we carry. The files are the product; the service is just the courier that never forgets.

I built Ziroo without investors so it could do one thing well and keep doing it for a long time. Delivering your records to you, and needing nothing back, is the whole of that one thing.

Ziroo is in early access. Add me to the waiting list, and every morning after launch, your archive gets a little more independent of everyone, including us.

Ziroo is an independent archive service and is not affiliated with, endorsed by, or sponsored by Xero Limited.