Isolation is enforced in the database
Every table in Meezly carries row-level security: the database itself refuses to return data that doesn’t belong to your account. It isn’t an application-level filter that a bug could skip. It’s the storage layer saying no.
- Row-level security on every table (account isolation at the database layer)
- Invoice images and PDFs in private storage, never on public URLs
- All traffic encrypted in transit (HTTPS); data encrypted at rest
- Password-based sign-in with secure session handling
AI processing happens server-side, on our keys
Document reading runs on Meezly’s servers against Anthropic’s commercial API. Your documents never pass through your browser to a third party, API credentials never leave the server, and Anthropic’s API terms do not permit training on this data by default.
Xero, on your terms
The Xero connection uses Xero’s own OAuth consent, so Meezly never sees your Xero password. It writes draft bills, so your approval workflow in Xero remains the gate to your ledger. Revoke access at any time, from either side.
Straight answers
Security pages love vague reassurance; we’d rather be specific. If you or your accountant have a question this page doesn’t answer, ask us and you’ll get a direct answer from the people who built it.