What Wonvoice can touch, and what it can't.

What we're allowed to do in HubSpot

You grant these permissions when you install — this is the full list:

• Read deals, companies, contacts and line items — to work out what to invoice and who to bill
• Write to deals — only the invoice-status fields you choose, nothing else
• Create those fields for you — optional, kept in their own named group
• Show invoices on your deals — optional, using HubSpot's own invoice records

Wonvoice never touches your pipelines, workflows, or anything beyond the fields above. Uninstalling removes its access in one click.

What we're allowed to do in Xero

Three things, and nothing else:

• Create and update invoices — as drafts unless you choose otherwise
• Find and create contacts — the invoice recipient, matched against your existing contacts before one is ever created
• Read your account codes and tax rates — so invoices land on the right ones; read-only

Wonvoice cannot touch bank accounts, payroll, bills, or payments, and it never deletes anything in Xero. (For your auditor: the literal permissions requested are offline_access, accounting.invoices, accounting.contacts, accounting.settings.read.)

Where your data lives

Everything is stored in Amazon's London data centres. Your connection credentials are encrypted with keys unique to your business — one customer's credentials can never unlock another's. And every customer's data is walled off from every other's at two independent levels, so even a bug in our own code couldn't cross that wall.

• Stored: the deal details you map, invoice references and statuses, your settings, and a permanent record of every action taken
• Never stored: card numbers, bank details, or your customers' payment credentials — money never moves through Wonvoice

If Wonvoice disappeared tomorrow

Nothing breaks and nothing is lost. Your invoices and contacts live in Xero; your deals live in HubSpot. Wonvoice sits between the two systems — it is never the system of record for anything you can't afford to lose.

The honest bits

We're a new product and we'd rather say so than imply otherwise. We are not yet SOC 2 certified (it's on the roadmap and this page will say so when it changes). What we can show today: shadow mode means you watch it work before it's allowed to act, everything it does is permanently on the record, and going live is a decision you make one pipeline at a time — and can reverse any time.

Questions we haven't answered here: security@usewonvoice.com reaches a human.