Privacy statement

PowerLabs Automation Engine · Last updated 3 November 2026

Who we are

The PowerLabs Automation Engine (integration.powerlabs.co.nz) connects the business systems our clients use, such as Xero, Xero Practice Manager, MYOB, ApprovalMax, Autotask, Halo PSA, NinjaOne, FYI, Zoho, Microsoft Dataverse, Monday.com, ClickUp, MyPractice and Reckon APS, to each other and to Microsoft tools such as Excel, Power BI, Power Automate and Microsoft 365 Copilot.

PowerLabs is a team within Cloudland Limited, a New Zealand company. Cloudland operates the Automation Engine and is responsible for the personal information described here. We handle it in line with the New Zealand Privacy Act 2020 and our agreements with our clients.

This statement covers the Automation Engine only. It explains what it collects, why, who it goes to, how long we keep it and how we protect it.

Your organisation's data

The Automation Engine reads and sends business data, such as contacts, invoices, clients and jobs, between systems on behalf of the organisations that use it. That data belongs to your organisation. We only use it to provide the features your organisation has set up.

Your organisation decides what to connect and who can use each connection. It is responsible for having the right to share the data and for telling its own people and customers about it.

We pass this data through as each request is made. We don't keep our own copy of it, except as described under "How long we keep it".

What we collect

Your account:
- your name, email address and organisation;
- your access level;
- your password, which we only store as a one-way hash;
- your two-factor authentication settings.
Microsoft sign-in: if you sign in with Microsoft, we also keep:
- your Microsoft account's tenant ID, object ID and username;
- the IDs of the Microsoft Entra security groups you belong to. Your organisation can use these to decide who can use a connection.
Connection credentials: the access tokens, API keys, client IDs and secrets, and database logins that let the Automation Engine reach the systems your organisation connects. These are encrypted before they are stored.
Your own connections: some connections use each person's own login, for example to Xero. If you connect yours, we keep its access tokens (encrypted), which organisation it reaches, and when you connected and last used it. Only you can use it.
Machine logins and API keys your organisation creates. API keys and client secrets are stored only as hashes.
Security and audit records: who did what and when, for example:
- sign-ins;
- changes to users, connections and access;
- credentials created or revoked.
Each record includes your email address, your IP address and your browser's user agent.
Flow errors: when one of your organisation's Power Automate flows reports a failure to us, we keep a short summary so we can alert you and you can see recent failures: the flow's name and run, the error code and message from the step that failed, and any comment the flow adds. Passwords, keys, tokens, email addresses and long numbers are removed first, and the rest of the step's output isn't kept.
Usage counts: how many requests each organisation makes, by feature and connection, for billing and capacity planning. These don't include IP addresses. They don't say which person made a request, except through a person's own connection, where usage is counted against that connection.
Forms we host for clients: some of our clients use the Automation Engine to receive form submissions, which can include names, contact details and attached documents. Submissions go straight to a Microsoft Power Automate flow set up for that client, and we don't keep them.

How we use it

To sign you in, and to check that you're allowed to do what you're asking.
To move data between the systems your organisation has connected, when you or your organisation's automations ask us to.
To keep the service secure: detecting misuse, investigating incidents and keeping an audit trail.
To support you and fix problems.
To bill your organisation for its usage. Billing statements go into Cloudland's own service management system, Autotask.
To follow up problems: when Cloudland escalates a flow error, its summary (the same scrubbed details described above) becomes a support ticket in Autotask, against your organisation's company.

We don't:

sell data;
use it for advertising or marketing;
combine one organisation's data with another's;
use any of it to train, fine-tune or improve artificial intelligence models.

Who we share it with

We only send data to:

The systems your organisation connects (for example Xero, Xero Practice Manager, MYOB, ApprovalMax, Autotask, Halo PSA, NinjaOne, FYI, Zoho, Microsoft Dataverse, MyPractice, or your own Reckon APS database), when a request or automation calls for it. Each of these handles the data under its own terms with your organisation.
Microsoft:
- Microsoft Entra ID for Microsoft sign-in;
- Microsoft Azure, which hosts the Automation Engine and its database;
- your own organisation's Power Automate flows, Excel, Power BI or Microsoft 365 Copilot, when you connect them.
Our email provider: to send account emails such as password resets.
Security monitoring providers (Microsoft and CrowdStrike): they receive the server's activity logs, to detect threats.
Cloudland staff: who run and support the service, and only as far as their role needs.
Authorities: anyone the law requires us to disclose information to.

Microsoft 365 Copilot: when someone in your organisation connects the PowerLabs connector, Copilot can read accounting and practice data from your connections and show it to them. We ask for consent before this is switched on for a person. The data then goes to Copilot in your organisation's own Microsoft 365 tenant, under your organisation's agreement with Microsoft. It is never used to train AI models.

Your browser: our pages load fonts and scripts from Google Fonts, cdnjs (Cloudflare) and the jQuery CDN, so those services see your IP address when you open a page. We don't use analytics or advertising trackers.

Where it's stored

The Automation Engine, its database and its logs run in Microsoft Azure's Australia East region (Sydney).

Server health and security monitoring data is processed in the United States, by Microsoft Azure Monitor and CrowdStrike. This covers the server's operating system logs and endpoint security telemetry, not your organisation's records.

The systems your organisation connects, and Microsoft's sign-in service, may store and process data in other countries under their own terms.

How we protect it

All traffic uses HTTPS (TLS 1.2 or later).
Connection tokens, keys and database logins are encrypted with AES-256 before they are stored, and the database is encrypted at rest.
Health information. A practice that connects MyPractice can have patient health information pass through the Automation Engine to its own integrations. We don't keep copies. Only the people and systems the practice grants on that connection can use it, only the record types the practice turns on, and AI assistants never can. Every request is recorded in the audit log, without the health information itself. We handle it under the Health Information Privacy Code 2020.
We ask connected systems only for the access their features use. For example, a NinjaOne connection can read device and monitoring data, and change tickets only when your organisation turns writes on. It can never run scripts on, or restart, your devices.
Every person signing in to the website uses two-factor authentication, or Microsoft sign-in with your organisation's multi-factor authentication.
Access is limited by organisation and access level. Your organisation can also restrict each connection to chosen people, Microsoft groups or machine logins.
Your own connection can only be used by you: not by administrators, other people or machine logins. Administrators can see that you've connected, and can disconnect you.
Sensitive changes need you to confirm it's you again: with your password, or by signing in to Microsoft again if your account uses Microsoft sign-in.
Security-relevant actions are recorded in an audit log that can't be edited. A copy is kept outside the server, in Azure Log Analytics in Australia East, and access to the database itself is audited there too.
The server sits behind a firewall, its database is only reachable over a private network, and it's monitored by endpoint security software.

We follow the security standard Xero sets for apps that use its APIs, and we hold every connected system to that same standard. If a security incident affects your organisation's data, we'll tell your organisation promptly, along with Xero, other providers and regulators where required.

How long we keep it

Your account	While your account exists. When an administrator deletes it, your details are removed. Audit records keep your email address.
Connection credentials	Until the connection is deleted. You can also revoke access from the connected system itself, such as Xero's connected apps.
Your own connections	Until you or an administrator disconnect it, your account is deactivated or moved to another organisation, or the connection it belongs to is changed or deleted. Its tokens are then deleted, and we ask the provider to revoke them where it supports that (Xero does).
Data from connected systems	Not stored. Reference data such as charts of accounts and tax rates is cached for up to 10 minutes. Exports are streamed to you and not saved. Notifications waiting to be delivered can hold a small part of the data for up to 30 days if delivery keeps failing. Flow error summaries (above) are kept for 30 days.
Microsoft group memberships	Replaced each time you sign in with Microsoft, and ignored once they're more than 31 days old.
Sign-in sessions and tokens	Website sessions: 2 hours. API access tokens: up to 2 hours. Refresh tokens: up to 30 days. Expired tokens are removed after 7 days.
Audit records	7 years, then deleted. Xero's security standard requires at least one year, and the database refuses to delete anything younger. The copy in Azure Log Analytics, and the database's own audit records, are kept for the same 7 years.
Error and audit log files	14 days for error logs, and 90 days for audit log files.
Flow error summaries	30 days, then deleted. One that's escalated also becomes an Autotask ticket, kept with Cloudland's support records.
Usage counts and billing statements	Kept for billing and accounting records. They don't identify individual people, except usage through a person's own connection, which is counted against that connection.

Cookies

We only use cookies the website needs to work:

a session cookie that keeps you signed in;
a security token that protects forms;
if you tick "Remember me", a cookie that keeps you signed in on that browser.

We don't use tracking or advertising cookies.

Your rights

Under the Privacy Act 2020 you can ask for the personal information we hold about you, and ask us to correct it. Your organisation's administrators can also update or remove your account.

If you're unhappy with how we've handled your information, please contact us first. If we can't resolve it, you can complain to the Office of the Privacy Commissioner.

Changes to this statement

We review this statement whenever the Automation Engine changes how it handles information, and we update the date at the top.

Contact us

For privacy questions or requests, email info@cloudland.co.nz.