According to Xero’s Services Agreement, you must keep a copy of all data entered within the service. Xero is not responsible for any data loss, regardless of how it occurred.
Of course, Xero will do its best to ensure your data is secure and accessible, but it won’t be able to help if the issue comes from within your company. For example: accidental or malicious deletions, transactions imported incorrectly, etc. will not be recovered.