Software spend audit for Xero
ShadowLedger reads a Xero organisation and reports the recurring software spend nobody is watching: duplicate tools, subscriptions running unchanged for months, price rises, and renewals about to auto-charge. Read-only, and a CSV export works just as well if you would rather not connect anything.
Does ShadowLedger work with Xero?
Yes. Xero connects through its own OAuth flow, the same way QuickBooks Online does, and ShadowLedger only ever reads. It creates nothing, edits nothing, and deletes nothing in your organisation. A Xero-only practice is not a second-class case here; both ledgers are first-class and always have been in the engine.
What does it read from Xero?
Transaction and vendor data: who was paid, when, and how much. That is the whole input. It does not read payroll, it does not touch bank feeds, and the OAuth scopes requested do not permit writes. The security page has the full data-handling detail, including how tokens are stored.
Why not just run a Xero report?
Xero holds every payment you have made, which makes it the right starting point, but it has no view that groups vendors into subscriptions. A supplier report gives you a total per contact. It cannot tell you the cadence behind that total, match a messy contact name to the product it actually is, notice that two suppliers sell the same thing, or compare a supplier against its own price history. Those four gaps are the audit.
What about spend that never touched a card?
That is most of the point. Software paid by bank transfer, cheque, or annual invoice is invisible to a corporate card tool and fully visible in the ledger. In the sample ledger on the demo page, $1,652 of monthly software spend sits on those rails. See card-blind spend for what that covers.
Can an accounting practice run this across clients?
Yes, and that is what the Firm plan is for: one console across a client book, with a findings report per client carrying your own logo and a prepared-by line. You can lead with a CSV export and never ask a client for account access at all. See ShadowLedger for firms.