How CrunchSync accesses Xero
Access is granted by you, one organisation at a time. You sign in to Xero, read what CrunchSync is asking for on Xero’s own authorisation screen, and choose the organisation to connect. Nothing is connected until you approve it there, and no CrunchSync page can create that authorisation on your behalf.
CrunchSync starts with read-only reporting workflows. It brings authorised Xero reporting data into a defined range of your Google Sheets workbook without changing the records in your Xero organisation.
You can withdraw the authorisation in Xero at any time, from Xero’s connected apps settings, without asking us first. A firm that connects several client organisations authorises each one separately, so removing one connection leaves the others untouched.
Setup is guided rather than self-serve: we connect your first Xero organisation with you, so you see each authorisation step as it happens instead of working through it alone. CrunchSync is an independent product and is not affiliated with Xero. Xero is a trademark of Xero Limited.
What this website ships
crunchsync.com is a static site served from Cloudflare’s network. It has one dynamic route, POST /api/trial, which handles the trial-request form. There is no login, no customer portal and no account data on this domain.
Every response carries the headers below. Open your browser’s developer tools, choose the Network tab, reload this page and select the document request to read them back.
| Header | Value | What it does |
|---|---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains | Your browser uses HTTPS for crunchsync.com and its subdomains for the next year, so a plain HTTP link is upgraded before the request leaves your machine. |
X-Frame-Options | DENY | No other site can load a CrunchSync page inside a frame. |
X-Content-Type-Options | nosniff | Your browser uses the content type we declare instead of guessing one from the bytes. |
Referrer-Policy | strict-origin-when-cross-origin | When you follow a link away from this site we send the origin only, never the full path, and nothing at all to a plain HTTP destination. |
Permissions-Policy | camera=(), microphone=(), geolocation=() | This site and anything it embeds are denied camera, microphone and location access by the browser itself. |
The only other rule the site sets is a one-year immutable cache header on content-hashed build assets under /_astro/. This site does not currently send a Content-Security-Policy header; when that changes, it will appear in the table above and the date at the top of this page will move.
This website sets no cookies, which is why you are not asked to dismiss a cookie banner. The Application tab of your developer tools will show you the same thing.
Analytics on this website
One analytics tool runs here: Fathom Analytics. Its script and dedicated site identifier are visible in the page source. It counts aggregate visits without setting analytics cookies, recording sessions, or building advertising profiles.
The trial form sends two events of its own: one when you first put the cursor in the email field, and one when a request is accepted. Those events contain only their fixed event names. They carry no plan, page identifier, acquisition category, email address, or form value, and they are not joined to the D1 trial-request record.
That category is worked out in your browser from UTM parameters or the referring domain, and it can only ever be one of ten values: campaign, direct, email, internal, organic_search, organic_social, paid_search, paid_social, partner or referral. Anything the server does not recognise is recorded as unknown. It is a bounded list of categories, not a record of where you were before.
What the trial form stores
The form has one visible field: your work email. Everything else in it is hidden context about the page you are on, or a spam check. When a request is accepted, this is the complete record:
- Work email address
- The address you typed. We use it to reply to you.
- Plan
- The plan named on the card you clicked, or
Not selectedif you asked from a page without one. - Source
- An identifier for the page or section the request came from, such as
article-xero-consolidated-reporting. - Acquisition channel
- One of the ten categories above, or
unknown.
There is no name field, no company field, no phone field and no free-text box, so there is nothing else to collect. The record is written to a Cloudflare D1 database and tagged with the project name crunchsync. Retention and your rights over that record are covered in the privacy notice.
Two spam checks run before anything is stored, and both are worth knowing about if you are testing the form. A hidden field named companyWebsite is a trap: it is invisible and unfocusable for a person, and a submission that fills it receives an ordinary success response and is then discarded. A submission sent within 1.2 seconds of the form script loading is refused with a message asking you to wait a moment.
What happens when something fails
Order matters when a form can fail. The trial route writes your request to the database first and sends our internal notification email second, so the two failure modes stay separate:
- If the notification email fails, the failure is logged and your request is unaffected. It is already saved, and the response you see is still a success — because it was one.
- If the database is unavailable, the form returns an explicit message and an email address instead of a success screen. A request is never quietly dropped and then shown as sent.
- If the email address does not validate, the form tells you so and nothing is stored.
This page publishes no uptime percentage and no service-level guarantee, because there is no published monitor behind one. A number here would be decoration. If you need a written availability commitment before you buy, ask us and we will tell you what we can and cannot agree to.
Sub-processors
Three providers process data for this website and the trial-request path.
| Provider | What they do | What they receive |
|---|---|---|
| Cloudflare | Hosts crunchsync.com and the Worker behind the trial-request route, serves DNS, and stores accepted trial requests in a D1 database. | Website requests, and the four trial-request fields listed above. |
| Fathom Analytics | Cookieless, aggregate analytics for this website. | Page views and the two trial-funnel events. No email address or form values. |
| Postmark | Delivers the notification email that tells our team a trial request has arrived. Used only when notification credentials are configured; when they are not, no email is sent and the request is still saved. | The four trial-request fields, inside a message addressed to our own inbox. |
Xero and Google are not on this list. Your Xero organisation and your Google Sheets workbook stay in accounts you control, under your own agreements with those companies, and you authorise the connection to each one directly. When this list changes, the date at the top of this page changes with it.
Reporting a security issue
Email mail (at) crunchsync.com with “security” in the subject line. It is the one address CrunchSync publishes, and reports are read by a person.
Include the URL or endpoint, what you did, what you expected, what happened instead, and the date and time. A request and response transcript is more useful than a scanner summary. We will confirm that your report arrived; we do not publish a response-time target, because we have not measured one.
Please do not run load tests or automated scanning that degrades the site for other people, and do not test against anyone’s live Xero organisation or workbook. We do not operate a paid bug-bounty programme.
Reviewing CrunchSync for someone else
If you are running due diligence rather than buying, this page is the substance of the answer: what you authorise, what is collected, who processes it, and what happens when part of it breaks. Send a security questionnaire to mail (at) crunchsync.com and we will answer it in your format. Where the honest answer is that we do not have something, it will say that.
This page claims no certification, audit report or compliance attestation, and none is implied anywhere else on this site. If a SOC 2 report or an ISO 27001 certificate is a hard requirement for your review, raise it before you spend time on the rest of the evaluation.
For the mechanics behind the connection, read what CrunchSync does. For plans and what each one includes, see pricing. For how a trial is set up and supported, see support.