Questions about Canari

NZ$49 a month per Xero organisation. The first month is free. There is no annual plan and no minimum term — you are billed a month at a time and can stop whenever you like, effective at the end of the month you have paid for.

We are not registered for GST, so the NZ$49 is the whole charge. When we register, GST is added to it rather than taken out of it. A GST-registered business claims that back, so what Canari costs you does not change. We will tell you before it affects your bill.

Canari is set up with you rather than through a sign-up form, so it starts with an email to hello@verionventures.com. Before anything is connected we check that your debtor book is one Canari can work with: it monitors New Zealand companies, so a ledger of mostly individuals or overseas businesses would give it very little to report.

You get an email that morning. It names the customer, quotes what was published, says what it means in plain English, and shows what they owe you from your own ledger. Where the register or the notice carries the liquidator’s name, firm and contact details — which is what you need to file a creditor claim — those are in the email too.

What you do next is entirely yours. Canari does not chase anyone, does not contact your customer, and never touches your ledger.

It will sometimes be unsure, and when it is, it asks you rather than guessing. New Zealand ledgers are full of trading names, abbreviations and near-identical company names, so a match is offered with the details a human can recognise — the trading name, the street, the industry — and you confirm or pick a different one.

If you tell us a company is not your customer, we stop monitoring it and close anything we had already raised about it. If you think something we show is wrong, email us and we will look. Where the error is in the public register itself, we will tell you which agency to approach — we cannot correct their records.

No, and it is worth being clear about the difference. A credit bureau holds things Canari cannot see — most importantly, whether a business has defaulted on payments to other suppliers. That is the single most predictive early signal there is, and Canari does not have it.

What Canari does is different: it watches the businesses you already trade with, continuously, without you building a list, and tells you the day something is published. The two are complementary. If you run credit checks before opening an account, keep doing that.

Canari is built on Xero’s public API as a registered developer, and we have completed Xero’s developer-partner security requirements — the self-assessment covering how we store your credentials, who can reach your data, and what we do if something goes wrong.

Canari is not a certified Xero app and is not listed in the Xero App Store. Certification is a separate Xero programme with its own entry requirements, and Canari is not in it. We state that directly so a badge is never assumed on our behalf.

Canari is an insolvency early-warning service. It looks at the customers in your Xero ledger and checks each one against two public New Zealand sources — the Companies Register and the Gazette’s insolvency notices. When something is published about one of them — an application to liquidate, a receiver appointed, a company struck off — we email you what it says, what it means, and what that customer owes you from your own ledger.

Read-only access to your contacts — nothing more. When you connect Xero, the permission screen you see will only ever ask for contacts. We cannot write anything back to your ledger, and we never ask to see your invoices, bank accounts, payroll, or transaction history — the connection simply doesn’t have access to them.

From each contact we store their name, their email address if Xero has one on file, and the total amount they currently owe you (outstanding and overdue). That’s the entire dataset we pull from your ledger.

Your data is stored in Australia (Sydney), with row-level security enforced in the database — meaning one business’s data is inaccessible to another at the database level, not just in the app’s code. Your Xero connection tokens are encrypted at rest (AES-256-GCM) before they’re ever written to disk, and every connection — between you and Canari, and between Canari and Xero — travels over an encrypted (TLS) connection.

No, and there is no model of any kind. Canari reads what the Companies Register and the Gazette actually say about a company — in liquidation, an application filed, removed from the register — and tells you which one it is, in plain English, with a link to the notice so you can check it yourself. There is no rating and no percentage: we show you the register’s own words, not a number we invented. Your ledger data is never sent to an AI model or used to train one.

Canari sends you three kinds of email, and only the first arrives on its own:

• Alerts, when something has actually happened to one of your customers. There is no weekly summary and no marketing — a quiet month is a silent month. Each thing we find is emailed once; we never send the same alert twice.
• A sign-in link, each time you ask for one. That is how you sign in — there is no password.
• An invitation, if somebody at your business adds you to their Canari account.

Alert emails carry a link to turn them off, and there is a switch in Settings. Either one applies to you alone — your colleagues keep theirs, and alerts still appear in Canari when you sign in. The other two have no off switch because they are not something we decide to send: one is you signing in, and the other happens once.

Yes, in our own database and nowhere else. We record which screens you open, the decisions you make in the app, and whether you clicked the link in an alert email — so we can tell which parts of Canari are worth keeping.

We don’t use Google Analytics or any other analytics company, and we don’t record your screen. Those tools would mean sending your customers’ names and balances to a third party, and that is your commercial information, not ours to pass on.

No. We don’t sell your data, share it with other Canari customers, or use it for advertising. It’s used for exactly one purpose: matching your customers against public insolvency records and telling you when something is published about them.

We rely on a small number of service providers to run Canari:

• Xero — the source of your ledger data, at your direction.
• Supabase — our database and login provider, hosted in Sydney.
• Vercel — hosts the Canari application itself, also served from Sydney.
• Resend — delivers every email Canari sends you: alerts, your sign-in links, and invitations.
• MBIE and the New Zealand Gazette— public register and insolvency-notice lookups. We send MBIE a company number, or your customer’s name as it appears in your contact list, to find the right company — never your balances or invoices. The Gazette we only read.

Disconnect Xero from Settings in Canari. Monitoring stops immediately, and Canari’s access is revoked at Xero in the same step, so nothing is left to remove under your connected applications. You can also revoke access from within Xero itself, which takes effect immediately on Xero’s side.

To have your data deleted from Canari, email canari@verionventures.com and we will delete your stored ledger data, contacts and alert history within 30 days. Deletion requests are handled by the operator rather than by a self-service control in the app; if that changes, this page will say so.

Canari is operated by Verion Ventures Limited, New Zealand company number 9450207 (NZBN 9429053875129), in Auckland. You can look that company up on the same Companies Register Canari reads. The terms of service name it as the party you contract with.

The commitments that come with that are specific and written down. Canari holds read-only access to your Xero contacts and balances and nothing else. Your Xero tokens are encrypted with AES-256-GCM before they are stored, organisations are separated by row-level security in the database itself, and there are no passwords to steal. Under the Privacy Act 2020 we will notify you and the Privacy Commissioner of any breach that risks serious harm, and we will notify Xero where Xero-sourced data is involved. The security overview sets out each control, and every claim on it is one that has been measured.

Canari does not hold SOC 2 or ISO 27001 certification, and does not claim to. It has completed Xero’s developer-partner security requirements, which is the assessment that governs how your Xero credentials are stored and who can reach them.

Questions not answered here? Email us at canari@verionventures.com.