Connecting a Xero organisation
Connecting works through Xero's own login and consent screen. You approve access there, not on LedgerWatch. We never see your Xero username or password.
What permissions LedgerWatch requests
The consent screen asks for two things: your identity (name and email, so we know which Xero user authorised the connection), and read-only access to Contacts.
The Contacts permission is read-only. LedgerWatch can see a contact's name, whether it's flagged as a supplier, and its bank account details. It cannot create, edit, or delete anything in your Xero file, and it cannot see invoices, bills, payments, or any other part of your accounts. There is no permission that would let LedgerWatch change a bank detail, approve a payment, or do anything other than read and compare what's already there.
Why we ask for offline access
Xero access normally expires quickly once you close the tab. LedgerWatch also asks for a refresh token, so it can keep checking automatically every 15 minutes without you needing to log into Xero again each time. You can withdraw this at any time, either from Xero's own connected apps settings or by disconnecting the organisation inside LedgerWatch (see Cancelling, disconnecting, and deleting).
What happens after you connect
You'll land on that organisation's alert settings page, with your own email address already set as the alert recipient. That's so monitoring works straight away rather than quietly sending alerts nowhere. You can add up to five recipients, and you should think about who they ought to be — see Choosing who gets alerts, because the person who edits supplier records is usually the wrong person to be the only one told.
LedgerWatch then takes an initial snapshot of every contact's bank details. This is the baseline everything else is compared against. Nothing before this point is checked: monitoring starts from the moment you connect, not before. Once the baseline is done you'll get a short summary email confirming what's now being monitored.
If an organisation ever ends up with no alert recipients at all — for example if you remove the last one — a warning appears at the top of your dashboard and that organisation's page. Changes are still detected and recorded while that's true, but nobody is told about them until you nominate someone.
From then on, LedgerWatch checks the organisation every 15 minutes and compares it against what it recorded last time. If a bank detail has changed, an alert goes out (see What an alert means and what to do).