Security Policy

This page describes how 10X ERP protects the data our clients keep in the 10X ERP platform (the “Service”). It describes what we do today. This policy is incorporated by reference into our client agreements.

How we handle personal information collected through this website is covered separately by our Privacy Policy.

The Service runs on established cloud infrastructure providers in data centers in the United States. Your production data is stored and processed in the United States. A second encrypted copy of your backups is also kept with a separate provider, described under Backups below.

Every client has its own database with its own credentials. No tables are shared between clients, and one client's application cannot connect to another client's database.

Servers are built from version-controlled configuration. Only web traffic and administrative access are reachable from the internet; databases, caches, and queues are not.

In transit: All connections to the Service use HTTPS with current TLS versions. Plain HTTP requests are redirected, and browsers are instructed to use HTTPS only. Administrative access uses SSH with key-based authentication.

At rest: Backups are encrypted with AES-256 before they leave the server. User passwords are stored only as salted hashes. Payment card details are held by the payment processor you connect, not by 10X ERP.

Access inside the Service is role-based. Your administrators grant each user the permissions they need, and every change to a user's permissions is recorded in a history your administrators can review.

• Multi-factor authentication is available to every user and required for users who manage other users or administer the account.
• Single sign-on through Google Workspace or Microsoft Entra ID lets your own identity provider's policies apply.
• Sign-in attempts are rate limited to protect against password guessing.
• API access uses per-user credentials that carry that user's permissions.

Access to production systems is limited to a small group of 10X engineers. Each uses individual credentials, which are revoked when someone leaves the team.

10X staff access client data only to deliver support you have asked for, to troubleshoot a problem, to operate and secure the Service, or when the law requires it. We do not sell client data or use it for any purpose other than running the Service for you.

10X AI, the assistant built into the Service, answers questions using read-only access to your data that excludes sensitive fields such as password hashes and security tokens. Changes it proposes go through the same permission checks as a user, with an audit trail.

Questions and the data needed to answer them are sent to the model providers listed under Subprocessors for that request only. They are not used to train models.

Databases are backed up continuously, with incremental backups at least every 30 minutes, to encrypted storage separate from the server. This lets us restore a client to any point in time within the last 30 days. Separate daily copies are kept with a second provider for up to a year. Server configuration is backed up nightly.

Restoring from backup is a scripted procedure. We exercise it regularly, because the same procedure refreshes our test environments from production backups, and we periodically rehearse a full rebuild.

Monitoring alerts the engineering team to errors, outages, and unusual activity. When we suspect a security incident, we confirm it, contain it, remove the cause, and determine what will prevent it from happening again.

If an incident affects your data, we notify your account contact by email promptly after we confirm it, with what happened, what data was involved, what we have done, and what, if anything, you should do.

These third parties store or process client data on our behalf. This page is the current list, and we update it when a subprocessor changes.

Integrations you choose to connect, such as payment processors, bank connections, sales tax services, shipping carriers, and accounting software, receive data only after your administrators enable them.