Xero Integration

The Xero integration in Sprinto enables you to monitor and manage user access to your accounting system for compliance purposes.

Sprinto connects to Xero via Truto, a secure third-party integration provider, to fetch user access data and automate access-related compliance checks.

This integration helps you:

• Track who has access to Xero
• Identify unauthorised or stale access
• Ensure access is removed for offboarded employees
• Maintain compliance with frameworks such as SOC 2 and ISO 27001

How it works

Sprinto integrates with Xero using a Truto-managed OAuth connection.

1. You initiate the connection from Sprinto.
2. Authentication and authorisation are handled via Truto.
3. Truto securely connects to Xero and retrieves user access data.
4. Sprinto stores only the connection reference (not raw credentials).
5. User and access data is periodically synced for compliance monitoring.

Sprinto uses this data to:

• Run access reviews
• Track user roles and permissions
• Trigger alerts for non-compliant access scenarios

Sprinto checks for Xero

Below is the list of checks available on Sprinto for Xero

Prerequisites

Before connecting Xero, ensure the following:

• You have an active Xero subscription.
• You have admin access (or equivalent permissions) in Xero.
• Pop-ups are enabled in your browser.
• You have access to create or manage integrations (if using client credentials flow).

Permissions and access

Permissions required

Sprinto requires read-only access to Xero data.

Typical access includes:

• User directory
• Roles and permissions
• Organisation access details

OAuth scopes (managed via Truto)

• accounting.settings.read
• accounting.contacts.read
• accounting.reports.read (if applicable)
• openid, profile, email, offline_access

Access requirements

• Xero admin or user with user management permissions
• Ability to authorise integrations

Features

The Xero integration enables:

• Access visibility
  View all users with access to Xero.
• Access reviews
  Periodically review and validate user access.
• Offboarding compliance
  Ensure access is revoked when employees leave.
• Role tracking
  Monitor user roles and permission levels.
• Automated evidence collection
  Capture audit-ready data for compliance frameworks.

Use cases

Set up Xero integration

Step 1: Navigate to Xero integration

1. Log in to the Sprinto dashboard.
2. Go to Settings → Integrations.
3. In the All tab, search for Xero.
4. Click Connect.

Step 2: Review permissions and data access

A drawer opens displaying:

• Controls and checks automated
• Permissions required (read-only access)
• Data collected by Sprinto:
  • Roles
  • Username
  • Status
  • Primary email
  • 2FA status

Review the details and click Next.

Step 3: Confirm setup requirements

In the setup drawer:

1. Review the integration steps.
2. Select I have admin access to my Xero account.
3. Click Connect to Xero.

Step 4: Enter credentials and authorise

A pop-up appears to complete authentication.

1. Review the required permissions.
2. Enter your Client ID & Client Secret. Know more about how to retrieve your Client ID & Client Secret.
3. Click Connect.

Once completed, the integration is established.

Post-connection flow

After connecting Xero:

• Sprinto automatically initiates a user sync.
• Xero can be added as a critical system for access monitoring.
• Access review workflows become available.
• Offboarding checks are activated to ensure access removal.

You can verify the connection under:

• Data Library → Access

Troubleshooting

Authentication issues

Permission issues

API and connection errors

Additional considerations

• Integration uses Truto, so authentication is managed externally.
• Sprinto stores only connection metadata, not sensitive credentials.
• Rate limits:
  • Truto: 50 requests per 10 seconds
  • Sprinto: 200 requests per 10 seconds (aggregated)