What the export does and does not establish
Xero explains that organizational data is exported from individual product areas and reports rather than one universal export. The user’s role affects access, with separate considerations for payroll reporting. Plan the collection around specific record types, and verify coverage before describing the resulting package as complete.
Content boundaries to review
An accounting practice may administer many Xero organizations without owning their commercial records. Invoices, bank descriptions, expense claims, payroll details, and attachments can reveal sensitive information about clients and individuals. Cross-client aggregation creates an additional review problem: permission for one organization does not automatically cover another, even if both use the same accountant.
Prepare a narrow candidate collection
Define one approved organization and use case for the pilot. Keep payroll and tax-related identifiers out of ordinary accounting examples. Separate structured transaction fields from source documents and free-text descriptions. Review counterparty names and reference numbers for reidentification risk. If the task can be demonstrated with newly authored examples, consider that route before collecting operational records.
Evidence to preserve
Preserve organization identity in a restricted manifest, user role, export area, report filters, reporting basis, currency, and capture date. Record how invoices, payments, and credits were linked. Keep client authorization and any limitations on downstream uses attached to the relevant cohort. Validate counts and totals across files so missing areas are visible rather than silently treated as zero.
Validate before offering a sample
A useful candidate should retain the economic meaning of each example after minimization. Check whether removed references break payment matching or duplicate detection. Distinguish illustrative synthetic records from actual transactions and document how any synthetic examples were produced. Review the proposed license with the data owner before sharing, rather than treating accountant access or export capability as commercial authority.
Before any external sample or sale, have the responsible rights and privacy reviewers assess the proposed recipient, training or evaluation purpose, retention, redistribution, and deletion obligations. Preserve the relevant contract versions and written decisions. These preparation steps are a review framework, not a legal conclusion or a statement that the platform endorses commercialization.