Question 1

What is dexIQ?

Accepted Answer

dexIQ is your AI bookkeeping team. You connect your accounting inbox and your accounting system, and AI agents work alongside your people across the books: reading and classifying email, capturing and coding invoices, reconciling, and preparing compliance and reports. A human approves every action by default.

Question 2

Can AI really do my bookkeeping?

Accepted Answer

AI is very good at the high-volume, rule-based parts of bookkeeping: reading invoices, classifying email, coding transactions, matching bank lines, checking GST. dexIQ automates those and hands anything uncertain to a person. It does not replace the judgement of an experienced bookkeeper or accountant, and it does not lodge or pay on its own.

Question 3

Will dexIQ replace my bookkeeper or accountant?

Accepted Answer

No. dexIQ works alongside your team, not instead of it. It takes the repetitive, clerical work off their plate so they can spend time on review, exceptions and advice. A human sits on top and approves every action by default, and the AI never takes an irreversible step on its own.

Question 4

What does dexIQ automate?

Accepted Answer

Inbox triage and classification, accounts payable, bank reconciliation, month-end tasks such as accruals and clearing-account recs, GST coding and draft activity statements, and management reporting. Any work that starts in an inbox or involves repetitive data extraction and validation is a candidate.

Question 5

Which accounting systems and inboxes does it connect to?

Accepted Answer

On the inbox side, dexIQ connects to a standard or shared accounts mailbox on Microsoft 365 and Outlook, and to Google Workspace and Gmail. Both are ready today. On the ledger side it connects to your accounting system: Xero is fully supported today, SAP Business ByDesign is releasing soon, and MYOB and NetSuite are on the roadmap. If you are on another system, talk to us.

Question 6

Who is dexIQ designed for?

Accepted Answer

Bookkeeping firms who want to do more with the same headcount, and businesses of all sizes who want the clerical work handled without adding people. It suits teams with growing transaction volumes and shared finance inboxes.

Question 7

How does dexIQ keep my data safe, and is it used to train AI?

Accepted Answer

Your data is not used to train AI models. dexIQ stores only what it needs to process your work, keeps each customer isolated, and logs every action in an immutable audit trail. Your data is stored on AWS in the Sydney region, with resilience across separate sites inside that region, your inbox and accounting system stay your systems of record, and SOC 2 is in active readiness. We are careful to describe what is in place and what is in progress.

Question 8

What happens when the AI is not sure?

Accepted Answer

Every extraction and match carries a confidence score. Low-confidence or flagged items are routed to a person for review, not pushed through. dexIQ never releases a payment, changes supplier bank details, approves above your threshold, or overrides a control without a human.

Question 9

How is dexIQ priced?

Accepted Answer

You pay for work completed, and you can keep monthly spend predictable. dexIQ offers annual credit commitments: pre-purchase a year of credits at a discounted rate and use them as your workload requires, amortised into a flat monthly amount. You get an outcome-based model without the volatility of usage-based billing.

Question 10

How long does onboarding take, and what do you need from us?

Accepted Answer

Most customers are operational within 10 minutes. You provide inbox access, authorisation to your accounting system, your workflow rules and a small sample of documents. No technical expertise is required, and dexIQ runs alongside your current process rather than replacing it.

Question 11

Is dexIQ secure, and how do you protect our data?

Accepted Answer

Security is built into how dexIQ works, not bolted on. Your data is encrypted in transit and at rest, access is tightly controlled and logged, we connect through secure OAuth rather than holding your passwords, each customer is fully isolated, and a human approves every action the AI takes by default (you can turn on autopilot for predictable, low-risk work within your limits). dexIQ was built by a finance practice, for finance teams, so controls and auditability come first. We are happy to share our control mapping and answer your risk team's questions in detail.

Question 12

Do you use our data to train AI models?

Accepted Answer

No. Your data is never used to train, fine-tune or develop AI models. We use the standard commercial APIs of our AI providers, whose published terms state that API inputs and outputs are not used for training. Content is retained by the provider for up to 30 days for abuse monitoring, then deleted. A zero data retention arrangement is available and we are in the process of formalising it. We do not currently hold executed data processing agreements with our AI providers.

Question 13

Do you store our passwords or login credentials?

Accepted Answer

No. You connect your accounting system and inbox through secure OAuth, so dexIQ never sees or stores your passwords. We hold only scoped access tokens for the connection you authorise, kept in a managed secret store, encrypted at rest and access-controlled. No third-party provider is ever given your credentials, and you can disconnect at any time.

Question 14

Is our data encrypted?

Accepted Answer

Yes. All traffic to and from dexIQ is served over HTTPS, with TLS 1.2 as the enforced minimum and TLS 1.3 used wherever your browser supports it. Data at rest is encrypted: the database, the invoice documents and attachments in object storage, and the backups. Staff devices are full-disk encrypted.

Question 15

Where is our data stored?

Accepted Answer

dexIQ runs on Amazon Web Services in the Sydney region, and client data is stored there. Resilience is a Multi-AZ deployment within that region, meaning separate sites inside Sydney. There is no separate disaster recovery region. Your systems of record remain yours: Microsoft or Google for the mailbox, Xero for the ledger. dexIQ reads from them under the connection you authorise. Storage is onshore, but some of the services we use sit overseas. Sub-processors receiving client content: our AI providers (United States), PostHog (United States, session replay capturing on-screen content), Marker.io (bug report screenshots), and ABN Lookup (Australian Business Register, onshore) for supplier verification. Sub-processors receiving telemetry only: BetterStack (Germany, monitoring and logging) and Stripe (United States, subscription billing). The full sub-processor register is available on request.

Question 16

What data is actually sent to the AI?

Accepted Answer

Scope is folder-level and set by you. dexIQ syncs only the mailbox folders you select, and nothing outside them is read. For classification, each message in those folders sends the subject, sender, recipients, the first 3,000 characters of the body, and attachment filenames. Attachment contents are sent only where a message proceeds on the transaction path, not for every message. There is no content-level filter. Any message in a synced folder is processed, including payroll or personal correspondence if it is filed there. You control scope by controlling which folders you sync. Every AI call is stateless and scoped to a single organisation, with no shared context between customers.

Question 17

Can the AI do something irreversible on its own?

Accepted Answer

No. The AI is allowed to prepare, validate, recommend and explain, never to execute an irreversible action. dexIQ never releases a payment on its own, never changes a supplier's bank details without human verification, never approves above your threshold without sign-off, never overrides an existing control or approval chain, and never sends an external message of financial weight without a human. A human confirmation costs seconds; an unwanted payment can cost weeks.

Question 18

How do you handle privacy and personal information (PII)?

Accepted Answer

Our handling is aligned with the Australian Privacy Principles under the Privacy Act 1988. We do not store card data: subscription billing runs through Stripe, which is PCI DSS Level 1 certified. Minimisation is achieved by folder scope rather than by filtering content within a folder, so see the answer above on what is actually sent to the AI.

Question 19

Who can access our data?

Accepted Answer

Access is least-privilege and logged. You sign in through Microsoft, Google or Xero and inherit the multi-factor authentication those providers enforce; internally, MFA is mandatory and shared logins are prohibited. Only the engineers required to support the service can reach production, under role-based access control. Every action on invoices, approvals and connections is written to an audit log with the user, the action, the outcome and a timestamp. Secrets and tokens are never written to logs.

Question 20

Are you SOC 2 or ISO certified?

Accepted Answer

dexIQ is in active SOC 2 Type II readiness with Vanta; we do not claim certifications we do not hold. Our controls are designed against the recognised standards your auditors will know: ISO/IEC 27001 and ISO/IEC 42001, the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications, APRA CPS 230 and the Australian Privacy Principles. We are glad to share our control mapping and sub-processor register with your audit or risk team on request.

Question 21

What about prompt injection and other AI-specific risks?

Accepted Answer

An invoice or an email can carry text aimed at the model. We do not rely on being able to spot it. Our position is containment and the absence of capability, not detection. dexIQ cannot release a payment, approve a bill or move money. Those capabilities are not in the product, so an instruction asking for one has nothing to act on. Bank detail changes are a hard rule: never auto-actioned, always escalated to a person, enforced in the agent's own instructions and not only in the interface. Deterministic checks against authoritative sources (the ABN register, GST arithmetic) run outside the model, and every proposed action carries an audit record.

Question 22

How do you handle backups and disaster recovery?

Accepted Answer

Amazon RDS with daily automated backups and 30 day retention, Multi-AZ deployment and deletion protection enabled. Point in time recovery gives a recovery point objective measured in minutes. Backups are held within the Sydney region only, with no copy outside it. We do not operate a second region, and we will not publish a recovery time objective for total region loss until we have tested one.

Question 23

What happens if there is a security incident?

Accepted Answer

We maintain a data breach response plan aligned to the OAIC Notifiable Data Breaches scheme, covering assessment, containment and notification. If an incident affected your data, we would notify you promptly on becoming aware of it. A formal, exercised incident-response runbook is part of our current SOC 2 workstream.

Got questions? We've got answers.

Is it secure?

See dexIQ run your own books.