Security Policy

This page describes how 10X ERP protects the data our clients keep in the 10X ERP platform (the “Service”). It describes what we do today. This policy is incorporated by reference into our client agreements.

How we handle personal information collected through this website is covered separately by our Privacy Policy.

The production Service runs on established cloud infrastructure in data centers in the United States. Backup copies are kept with separate providers, described under Backups below.

Every client has its own database with its own credentials. No tables are shared between clients.

Servers are built from version-controlled configuration. Only web traffic and administrative access are reachable from the internet; databases, caches, and queues are not.

In transit: Connections to the Service use HTTPS. Plain HTTP requests are redirected, and browsers are instructed to use HTTPS only. Administrative access uses SSH with key-based authentication.

At rest: Our continuous database backups and server configuration backups are encrypted with AES-256 before they leave the server. User passwords are stored only as salted hashes. Payment card details are held by the payment processor you connect, not by 10X ERP.

Access inside the Service is role-based. Your administrators grant each user the permissions they need.

• Multi-factor authentication is available to users who sign in with a password, and your administrators can require it for users who administer the account.
• Single sign-on through Google Workspace or Microsoft Entra ID sends sign-ins through your own identity provider, so its policies apply when users sign in.
• Sign-in attempts are rate limited to protect against password guessing.
• API access uses per-user credentials.

Access to production systems is limited to a small group of 10X engineers, each with individual credentials. We remove an engineer's access when they leave the team.

10X staff access client data to deliver support you have asked for, to troubleshoot problems, to develop, test, operate, and secure the Service, or when the law requires it. We do not sell client data.

10X AI, the assistant built into the Service, answers questions using read-only access to your data. Changes it proposes in chat are made only after the user approves them, with that user's permissions and an audit trail.

Questions and the data needed to answer them are sent through OpenRouter to the model providers listed under Subprocessors. They are not used to train models.

Databases are backed up continuously, with incremental backups at least every 30 minutes, to encrypted storage separate from the server. This lets us restore your database to any point in time within the last 30 days. Server configuration is backed up nightly.

Separately, each client database is copied every hour to a second provider. We keep every hourly copy for 7 days, one copy a day for 60 days, and one copy a month for a year.

Restoring from backup is a scripted procedure.

Monitoring alerts the engineering team to errors and outages. When we suspect a security incident, we confirm it, contain it, remove the cause, and determine what will prevent it from happening again.

If an incident affects your data, we notify your account contact by email promptly after we confirm it, with what we know about what happened and what data was involved, what we have done, and what, if anything, you should do.

These third parties store or process client data on our behalf. This page is the current list, and we update it when a subprocessor changes. Services marked “when enabled” receive data only for accounts that use them.

Other services you connect to your account, such as accounting software or your own carrier accounts, receive the data that integration needs once it is connected.

If your review process needs a completed security questionnaire or more detail than this page provides, email info@10xerp.com with “Security questionnaire” in the subject line.

If you believe you have found a security problem in the Service or this website, email info@10xerp.com with “Security issue” in the subject line and enough detail for us to reproduce it.