What Finrely reads — and what it never writes
Last updated: 16 September 2026
The read-only guarantee
Every accounting source Finrely connects to — QuickBooks Online, Xero, Zoho Books, Odoo — is read-only, by construction, not by policy alone:
- Zoho Books: every OAuth permission Finrely requests ends in
.READ; there is no write, create, update or delete permission anywhere in the request. - Xero: every accounting OAuth scope Finrely requests ends in
.read(settings, reports, trial balance, P&L, balance sheet, aged receivables/payables). No write scope is requested. - QuickBooks Online: Intuit's OAuth model does not split its accounting scope into read and write, so the guarantee here rests on implementation, not the scope string — and the implementation calls only
GETrequests against QuickBooks' reporting and accounting API. - Across QuickBooks Online and Xero, the sync calls only
GETrequests. NoPOST,PUT,PATCHorDELETErequest is ever made against your books. - Odoo: the sync calls only the
readandsearch_readmethods over Odoo's own API. It never callswrite,createorunlink.
The only POST requests any of these connections make are to each provider's own OAuth token endpoint — exchanging or refreshing an access token, which is part of how the authorisation itself works, not a write to your accounting data.
What Finrely reads from Zoho Books
| Data | What it's used for |
|---|---|
| Chart of accounts | Account names, codes and types, used to map your accounts onto Finrely's reporting lines |
| Profit & loss | One report per month on an accrual basis, over a rolling window |
| Balance sheet | Closing position at each month end, over the same window |
| Documents (invoices, bills, journals, credit notes) | Read for analytics only — to attribute amounts to reporting tags and to counterparties, never for their own content |
| Reporting tags | Your tag groups become Finrely's analytic dimensions — business line, cost centre, category — so the P&L can be split by them |
| AR / AP ageing | Receivable and payable ageing by counterparty, captured at each month end rather than only as of today |
Finrely stores period aggregates derived from this data, not a copy of your ledger. See Zoho Books in Finrely for the connection flow and sync windows.
How it's stored
Access tokens are encrypted at rest (AES-256-GCM). The decryption key is held only in Finrely's server environment — a usable, decrypted token is never sent to your browser.
Disconnecting
Disconnecting a source revokes Finrely's authorisation and discards the stored credentials. It does not delete the reporting data already derived from your books — to have that deleted as well, write to [email protected].