Skip to content

Working with the IRD on cloud computing

A few tweets just came in noting that the IRD has issued an alert concerning location of data for cloud computing. There is no issue for Xero customers as we have been working with the IRD for some time on a blanket dispensation and assisting IRD on policies around the cloud.

Revenue Alert RA 10/02

Section 22 of the Tax Administration Act 1994 (“TAA”) requires a person who carries on any business or any other activity for the purpose of deriving assessable income in New Zealand, to keep sufficient records in New Zealand, in the English language, to enable the Commissioner to readily ascertain information about their tax affairs. The same requirements for GST records are contained in section 75 of the Goods and Services Tax Act 1985. Similarly, section 32 of the TAA requires that all gift-exempt bodies must keep in New Zealand sufficient records to enable the Commissioner to determine both the sources of donations made to them and the application of their funds.

It is the Commissioner’s view that only business records stored in data centres physically located in New Zealand will comply with the record keeping obligations in the Inland Revenue Acts. Taxpayers are responsible for ensuring they comply with their record keeping obligations. Therefore, taxpayers using a cloud computing service will need to be satisfied that all their business records will be stored in data centres located in New Zealand.

New Zealand legislation hasn’t kept up with developments in technology compared to other countries. We are working towards certification of our current customers and in the longer term expect to see the legislation amended to better reflect contemporary technology. We’d expect this to end up in a similar position to Australia where there is no onshore storage requirement, only that your records are available if requested. There are a number of fall back positions if the industry doesn’t get there.

As a leader in the industry we’ve been proactively working on this issue for some time for the benefit of other software developers.

We have a great relationship with the IRD and working with them on a range of initiatives as they understand the benefits of cloud technology to reduce compliance costs and improve small business productivity.

This is a great discussion we’ve been looking forward to having.

 

Read more about Company News

 

39 comments

Campbell Yule
13 December 2010 #

Phew! Nice and quick response!
Knew you guys would be on to it.

Gary
13 December 2010 #

Nicely done, great to have you and the team working so proactively.

Thomas Beagle
13 December 2010 #

So, where is Xero data stored?

What are the data protection laws like there? How about privacy laws?

Does the government of the country where the data is stored have a right to see it without some sort of warrant/due cause process?

Chris
13 December 2010 #

I’d be curious to know the basis for the blanket dispensation and how other vendors could get the same.

Mat
13 December 2010 #

Guys, I don’t see any mention of “dispensations” being granted, or for that matter even entertained, in that revenue alert Personally I’d be reluctant to breathe easy just yet until the IRD themselves actually say that yes, you are OK if you are using such-and-such a service. I expect Xero will be working with the IRD to get such a statement finalised? This alert couldn’t have come at a worse time – right when I was considering moving off of MYOB because they want to charge me another $800 for multi-currency.

Alastair Grigg
13 December 2010 #

@Thomas – Xero is hosted with Rackspace in the US (see for more details). We comply with data privacy laws of all major countries where Xero is used, including US, UK, Australia and NZ. Being hosted in the US does technically mean that a US Government agency can request access to your data with due cause. But I don’t expect you’ve got any reason to be concerned about that.

@Chris – We’re certainly taking the approach that we are having this discussion on behalf of the industry. We’ll share more information as we progress and would expect any dispensation or similar to be available to others who met any necessary criteria.

Rod Drury
13 December 2010 #

@mat The Alert says this

An alert should not be interpreted as being Inland Revenue’s final position. Rather, an alert outlines the Commissioner’s current view on how the law should be applied. For any alert we issue it is likely that some investigatory work has already been carried out.

We’re very engaged with the IRD and not expecting any issues. They have been very reasonable and understand what we are doing. So don’t hesitate coming towards the light.

Richard
13 December 2010 #

I suspect the warning is more towards people using google docs and similar to store stuff in a manner that IMO is beyond negligence and bordering on insane.

I wont use any service that doesnt leave me in a position to be able to have a copy of all my data in a format I can access stored in as many places as I like. Not looked into xero at the moment because its prices are more than I can justify for either business at the moment, but the number one concern of mine is that I do not get locked out of my data like is oh so easy to do with something like a google account.

Richard Francis
13 December 2010 #

It’s common knowledge that Xero have a great working relationship with the IRD and that the latter are trying hard to get with the Cloud. The IRD also routinely issue Interpretations on various matters as a way to dip the toe and get feedback.

Nothing to worry about, in fact Xero will no doubt get a good outcome for industry on this. :)

Lance Wiggs
13 December 2010 #

Great – solve it.
And also sort it out with the IRD (and Xero itself) so that we can upload photos of our paper invoices and receipts so that everything can be stored in the cloud and we can biff out those pesky paper files.
The more stuff in the cloud, the easier it is for the IRD to help us comply.

Regan Cunliffe
13 December 2010 #

@Rod Where’s the like button for your comment? :)

Blair Hughson
13 December 2010 #

I have 2 companies on Xero and absolutely love it. One question which is loosely connected to this issue – by NZ law you need to keep financial records for years after you close a business. Does that mean you need to keep paying for Xero for those years?

Rod, would Xero look at giving people the option to download an archive of their data which could be re-uploaded later in these cases?

James
13 December 2010 #

@Rod Thanks for providing a quick response. Pity we don’t have a definitive answer yet, but hopefully it will come. I was pretty surprised by the nature and tone of the IRD alert – there didn’t seem to be much consideration for the kind of cloud solutions (like Xero) that would be easily able to meet the intent of their policy.

@Richard – you are able to export your data from Google Docs in a range of formats with minimal effort. You can even script this to extract data via Google’s APIs to automate a backup process if you like. I would be much more concerned about small business owners relying on their PC hard-drive to store their business data. Storing it in Google Docs would be a fantastic step towards improving their backup and retention efforts in comparison.

Rod Drury
13 December 2010 #

@Blair We undertake to keep an archive copy of customers data for up to 7 years, even if they have cancelled their subscription. That seems like the best service we could provide so that’s what we did.

A full downloaded copy of the data could not be uploaded into a then later version of Xero because the data schema may have changed. But of course you can export data out of Xero in numerous ways. See Importing and exporting with Xero or How do I get my data out of Xero?

Dave Lane
14 December 2010 #

Why not create a NZ-based hosting infrastructure for NZ-based customers? Surely, once you’ve got your systems hammered out, you’ll have multiple data centres anyway for redundancy, and that sort of thing… That way, NZ-based Xero customers will also enjoy reduced latency, and not be cut off from their accounts when the undersea cables get yanked accidentally by bottom trawling fishing boats.

Doing that would also mitigate the off-putting risk of storing data in a place vulnerable to America’s completely unpredictable (and idiotic) legal system (and more idiotic and increasingly fascist government).

Guy
14 December 2010 #

Rod in respect of your comment to @Blair: are you able to request a copy of that archived information any time during that 7 year period (on the assumption you demonstrate ownership of that data)?

Also: it seems to me that a possible solution (I think others have referred to it) is that local NZ copies of that data are made by the customer as part of a regular back-up plan. Does Xero promote customers implementing back-up solutions to their data stored with Xero?

I use OneNet who are NZ owned & operated and have their data centres here in NZ – good to support another NZ company.

Rod Drury
14 December 2010 #

@Dave – we haven’t yet done this because it costs a lot of money and would slow us down. The business case doesn’t yet stack up to do it. We have a significant investment with the Akamai 55,000+ server Content Distribution Network (CDN) that puts most of Xero in the servers of our customers ISP, no matter where they are in the world.

@Guy you can export data from Xero now but round-tripping it back in is not something we yet support. This is mainly because we are evolving so quickly in this phase of the online accounting industry that there are no standard formats. As the product category stabilizes we’d anticipate this may happen in the future.

We already back up all our customers data to other sites and maintain a hot standby environment. Much more efficient for us to do this for our customers. But we do understand the psychological benefits of saving something yourself.

@Melissa Agree OneNet are a great company but we’re fighting physics and economics to run a global product from our remote islands.

Ryan Jennings
14 December 2010 #

@Rod Thanks for getting responding to the announcement and participating in the chat. Glad you’re working with the IRD. I’ve now added personal account sign up to my Xero company accounts.

Blair Hughson
14 December 2010 #

Cheers Rod, it’s always interesting to hear an inside-view of what’s happening with Xero.

Zack Levy
15 December 2010 #

Why not host with a cloud provider in AU/NZ? There are many many hosting provider, as good if not better than Rackspace, that can provide Private Cloud services. That will negate the need to go through this excruciating process with the IRD.

Paul Rushworth
15 December 2010 #

Hi Zack,

At this time, Xero runs on a mix of dedicated servers and virtualisation, but all this environment is dedicated to Xero.

Hosting at Rackspace is partially a scale issue for us. If there are any providers in Australia/NZ with 24/7 working Virt, Storage (and General) Engineers (note- rotating shifts on site working 24/7- not ‘on call’), then i’m not aware of them.

Paul.

Rod Drury
15 December 2010 #

@Zack. Answered in earlier comments above. Process isn’t excruciating at all. This is an expected discussion as legislation often trails technology. Had a call from the IRD yesterday who are following the discussion closely so everyone please feel free to keep discussing.

InternetNZ have been having a good discussion on their list as well.

Rod

David Turner
16 December 2010 #

Rod, I assume, therefore, that Xero is abiding by the law during the interim by storing back up data locally within New Zealand (as well as possibly in the States) at least until the situation can be aligned with Australia?

Sol
16 December 2010 #

QUOTE: “Xero is hosted with Rackspace in the US….Being hosted in the US does technically mean that a US Government agency can request access to your data with due cause. But I don’t expect you’ve got any reason to be concerned about that.”

Well, I’ve nothing to hide, but I do have reason to be concerned. I take privacy considerations seriously. I am concerned about my data being “randomly searched” by US officials – this happens frequently in the US by various national agencies who have sweeping powers.

I am actually very concerned that Xero does not have a local presencein NZ (being an NZ company?).

I will now be watching this subject very closely and actively researching local alternatives. if this situation is not remedied rapidly.

Sol

Jim Reay
16 December 2010 #

Offline access to data would be great, but is not a practial option, re Rod’s comment “round-tripping”. Exporting data may be easy for those in the know, but I would like to see it a more obvious option, perhaps even a default, and certainly only a click or two to save to a local drive. Although Xero undertake to keep for seven years, bad things happen, owners and procedures change, and data could become inaccessible or lost.

Sol
16 December 2010 #

Also, you might want to have a chat to Ross at Cruical Paradigm – they are an award winning hosting company in AU http://bit.ly/Crucial-Paradigm

Cheers
Sol

Rick Shera
16 December 2010 #

I’m an internet lawyer not a tax one (so you can’t rely on this if the IRD comes knocking ;-)) but it seems to me that an argument can be made that xero customers currently comply with the spirit at least of section 22 ( http://www.legislation.govt.nz/act/public/1994/0166/latest/DLM350462.html?search=ts_act_oaths_resel#DLM350462 ). I say that for two reasons:
1. The objective is for the IRD to be able to readily access the taxpayer’s records. Xero potentially makes that easier than if the records were stored in NZ in hardcopy or on a cheap PC susceptible to information corruption etc. So, even if there was a technical breach because the info is stored in the US, provided the information is available when the IRD requests it, hard to see an under resourced IRD taking a case that the records should have been in NZ. I suspect that if they did, it would be because they can’t access the records at all in which case you’ve got much bigger issues to face.
2. But, maybe there isn’t even a technical breach. The requirement is to “keep in New Zealand sufficient records” (s22(2)). As far as I can see, most if not all information recorded in xero will have source records somewhere else. For all money transactions via NZ banks, details will be here in the banking system. Assets and liabilities will likely be recorded here in source documents too (yours or other people’s) etc etc. There may be some I guess only recorded in xero (journal entries?) and of course is the source info itself is overseas, that doesn’t help.

The more difficult issue I suspect is historical records, where the source information may have gone.

Clearly the law is out of date. It sticks in the craw to admit it, but we need to catch up to the Australians – http://law.ato.gov.au/atolaw/view.htm?docid=TXR/TR20059/NAT/ATO/00001

Well done xero for seeing the issue in advance and working to get it fixed for all of us.

Anyway

John
16 December 2010 #

Here is a local NZ company that will backup data at affordable GB prices. Seamless realtime backup of all your non Xero data, and possible API in the future for Xero intergration to have a second secure location in NZ for those who require this such as the IRD?

Rachel McAlpine
17 December 2010 #

This is a fascinating issue. Thanks, Rick, for your perspective. To see the discussion in the open like this is refreshing and oh so easy. Like Xero.

Sue White
18 December 2010 #

Thanks Xero team for being up front and visible with this discussion.
Came over from MYOB and I cant stop telling people how much better Xero is … Keep it up.

[...] data in jurisdictions will not contravene domestic laws”. This mirrors some of the great work that Xero is doing across this side of the Tasman, attempting to get the New Zealand Inland Revenue [...]

Rizwan Ahmad
21 January 2011 #

Government rules cannot be change until repected legislative process is formulated. cloud computing has been mis-understood by various factions and I feel that if IRD have access to the financial records, there should not be any problem. One of the rigidity of law is, it does not pace with technological developments. what if the data kept in New Zealand is faced with natural disaster? Its time to understand cloud computing rather then making things difficult for its adoption.

Scott McLeod
28 September 2011 #

Hi,

I have been looking at xero as a possible solution for my company but have had this issue raised by staff. It appears to have been a while since this discussion was started so my questions are:

Has this issue been resolved?
Has anyone had any adverse results with IRD?
What if any are customers doing in the mean time to work around this issue?

Rod Drury
28 September 2011 #

Hi Scott,

The IRD’s latest guidance is they are working on the issue and they expect explicit clarification in the future. There is no current impediment and we have 50,000 customer on the platform. In addition we’ve proactively been working on a Cloud Industry Code of Practice to get ahead of these issues. The IRD remains very supportive of companies like Xero. No reason to wait.

Rod

Mark Lawton
21 November 2011 #

Hi

Can you please give me an update on this issue. As far as I know the IRD have not issued any dispensations yet (One year later). I think this issue needs addressing as the revenue alert was not issued in the distant past and so can not be said to be irrelevant due to technology changes. I know that workflomax have changed there servers to be compliant with NZ tax law. Should we be asking for dispensations for each of our clients using Xero or maybe Xero should have mirrored data backups in NZ? Maybe this could improve the speed of the application as well.

Paul Williams
21 November 2011 #

Hi Mark

In September a Bill was introduced in Parliament which looked to change the tax legislation to enable “Data Storage Providers” like Xero to apply on their clients behalf to keep their clients records outside New Zealand. However the Bill was not passed before the dissolution of Parliament for the Election. It is likely that the Bill will be reintroduced to Parliament early next year. Since the Revenue Alert was issued we have been working closely with the IRD on this and will provide an update once we have further information. At this stage we don’t believe any further action from you is necessary.

Paul
GM Finance – Xero

Tanya Hulme
22 November 2012 #

Hi Paul,
Today I attended the NZICA 2012 Topical Tax and IR update session. They mentioned Cloud Computing and that the IR Commissioner can give authority to a tax payer to keep records outside of New Zealand. It seems a bit onerous for each tax payer to apply. Have Xero been able to apply on behalf of their users? An update would be appreciated. Thanks.

@Tanya- There has now been some legislative change but no practical changes as yet. The Tax Administration Act 1994 was amended on 2 November 2012 to enable the Commissioner to authorise “persons” (like Xero and other SaaS providers) to hold, on behalf of tax payers, records outside New Zealand.(see Section 22 (2BA)). The IRD are now working on what their requirements will be to provide this authorisation and have released a draft Standard Practice Statement ED0150 for public consultation – responses are due by 21 December 2012. We are in the process of providing feedback to the IRD on this document and will be applying for approval as soon as the Standard Practice Statement is released. So each individual taxpayer will not have to apply, Xero will be seeking approval on behalf of all of its NZ customers.

Add your comment





We welcome all feedback but prefer a real name and email address.