Xero data loss: the terms say backups are your job

There's a sentence in Xero's terms of use that most subscribers have never read. It sits in section 37, under the heading "Data loss":

"Data loss is an unavoidable risk when using any technology. You're responsible for maintaining copies of your data entered into our services."

A backup service quoting that clause at you is convenient, I know. It's also word for word from Xero's own contract, the one you accepted when you created your subscription, and it assigns the job of keeping copies to you. Every quote in this article comes from the Australian edition of Xero's terms, last updated 11 February 2025 and current as of July 2026, so you can check each one yourself.

Most small business owners I talk to assume the opposite. The reasoning goes: it's in the cloud, the cloud is professionally run, therefore it's backed up and my part is done. The first two steps are true. The third is the one the contract corrects.

What the terms actually say

Xero writes a friendly plain-English summary above each section of legal text, and even the summary is direct about this one:

"You also may have occasional access issues and may experience data loss, so backing up your data is important."

Section 36 sets the tone for availability:

"You know how the internet works – occasionally you might not be able to access our services and your data. This might happen for any number of reasons, at any time."

None of this is buried or disguised. Section 37 even links to Xero's own guides on exporting your data, which is the company telling you, in its contract, to go do the thing this article is about. If you want to see what those export options produce, we walked through every one of them in how to export Xero invoices to PDF. The short version: they exist, they work, and every one of them is a manual chore.

What happens if Xero does lose your data?

Section 55 answers this precisely. Two quotes matter:

"For loss or corruption of your data, our liability will be limited to taking reasonable steps to try and recover that data from our available backups."

"Our total aggregate liability to you in any circumstances is limited to the total amount you paid us for your subscription in the 12 months immediately preceding the date on which the claim giving rise to the liability arose."

So the remedy for lost data is a best-efforts recovery attempt, and if that fails, liability is capped at roughly one year of subscription fees. On the Xero plans most small businesses run, that's a few hundred dollars against records the ATO expects you to produce for five years.

It gets more pointed. The same section excludes liability for a list of loss types, and sitting in that list, between loss of capital and damage to reputation, is this phrase: "legal, tax or accounting compliance issues." If lost records become a compliance problem, the contract says that consequence is yours. The services are also provided "as is" (section 54).

One honest caveat: if you're in Australia, consumer law guarantees that can't be excluded still apply, and Xero's terms acknowledge that in section 60. The caps above operate within whatever the law allows. But nobody should be building their record-keeping strategy on the hope of a favourable liability argument after the fact.

To be fair to Xero

None of this is a scandal, and it would be dishonest to frame it as one. This is standard cloud software contract language; comparable clauses sit in the terms of most SaaS products you already use. Xero also keeps its own backups (section 55 refers to "our available backups"), runs real infrastructure, and by the standards of cloud accounting is a serious operation.

The terms are the most honest document Xero publishes. They say exactly what the deal is: we'll run the platform well, we'll try to recover your data if something goes wrong, and you'll keep your own copies because no technology is loss-proof. That's a reasonable deal. What's broken is the reading rate: almost nobody on the customer side knows what their half says.

What "maintaining copies" actually means

A CSV you exported sometime last year doesn't meet the standard the contract implies, let alone the one the ATO sets: records kept for at least five years, accessible and readable the whole time. Working through what a real copy looks like:

• Documents, not just data. A spreadsheet of invoice numbers won't satisfy an auditor who wants to see the invoice. You need the PDFs as issued, and the data alongside them.
• Storage you control. A copy that lives inside someone else's subscription is a copy you can lose with the subscription. Your own Google Drive, Dropbox, OneDrive, or server counts. Another vendor's walled garden doesn't.
• Current. Records age. A backup routine you run "when I remember" produces an archive with holes exactly where the awkward questions land.
• Readable without the platform. The test is simple: if your Xero login stopped working today, could you still open yesterday's invoices?

You can meet all four requirements manually. Export routines exist, and for a business with light volume and good discipline they're workable. They're also the kind of task that's easy to skip for one busy month, and then for six.

The set-and-forget way to follow Xero's advice

Ziroo exists to do section 37's homework automatically. Every morning it delivers the invoices, quotes, and purchase orders created or updated in your Xero organisation over the last 24 hours, as individual PDFs plus a CSV manifest, to your inbox and to cloud storage you own. The connection is read-only, and the archive stays readable with no Xero seat and no Ziroo login, which is exactly the "copies of your data" the contract asks you to maintain.

Ziroo is in early access. Add me to the waiting list and you'll get access as spots open.

Section 37 is good advice

Read it once more: keep copies of your own data, because loss is an unavoidable risk with any technology. Xero put that in writing and had you agree to it. The only mistake is treating it as fine print instead of instructions.

Add me to the waiting list and the instructions follow themselves from tomorrow morning.

Quotes are from the Australian edition of Xero's terms of use, last updated 11 February 2025, viewed July 2026. Section numbering varies by region. This article is general information, not legal advice. Ziroo is an independent archive service and is not affiliated with, endorsed by, or sponsored by Xero Limited.