Query Abacus and Bexio in the chat without exporting data

The way in: the official interfaces

Bexio offers a public REST API with OAuth 2.0. Each person signs in with their own Bexio account, so their permissions automatically apply in the chat as well. For Abacus, we use the interfaces your installation provides; which ones these are depends on the version, operating model and licensed modules. We clarify this before the proposal, because this is exactly what the effort depends on.

The MCP server runs in your infrastructure or in a Swiss data centre and is the only point that talks to Abacus or Bexio. Direct access by the language model to your ERP is not intended.

Permissions: what someone cannot see in Abacus, they cannot see in the chat either

A pilot with a single technical user sees everything or nothing. In production, each request is assigned to the requesting user and executed with that user's permissions. In Bexio, this follows from the per-person sign-in; in Abacus, from the assignment to users or roles. Payroll data and other particularly sensitive areas remain excluded unless you explicitly approve them.

What SMEs and fiduciary firms actually use it for

Receivables and liquidity

“Which open items over CHF 10,000 are older than 60 days, and who sent the last reminder?” instead of an open-items list that first has to be filtered.

Preparing closings and VAT

Have anomalies, missing receipts and unusual postings compiled before the quarterly or annual closing. The return itself remains with a human.

Orders and quotes

Query the status of quotes, orders and deliveries across customers, for example before a customer meeting.

Clients of fiduciary firms

Questions about the client base in plain language, with client separation through employees' permissions.

Data protection under the FADP

Anyone who has a platform provider work with personal data generally needs a data processing agreement (Art. 9 FADP). If the provider is located abroad, the rules on disclosure abroad also apply (Art. 16 FADP). We set out the options: enterprise offerings with data residency and without storage of inputs, operation in Switzerland, or local models where no data leaves the premises.

We provide the architecture information that the person responsible for data protection in your organisation needs for the assessment. This does not replace legal advice.