Security

10ex (operated by Fairfax Investment Partners LLC) runs the go-to-market workflows that handle your company's most sensitive commercial data — your customers, pipeline, and outreach. We treat that data as the core of our responsibility to you. Our program follows a defense-in-depth model: data is encrypted, access is least-privilege, and every layer of the stack is monitored.

10ex is CASA (Cloud Application Security Assessment) certified and aligns its controls with industry frameworks including SOC 2 and ISO 27001. Where a certification is in progress rather than complete, we say so explicitly below.

The Service is hosted on major cloud infrastructure providers that maintain their own SOC 2, ISO 27001, and PCI DSS certifications. Production environments are logically isolated from development and staging, and customer workloads run in segmented, access-controlled environments.

• Hosted on hardened, continuously patched cloud infrastructure
• Production isolated from staging and development environments
• Network segmentation, security groups, and private networking by default
• Automated backups with point-in-time recovery for critical data stores

Your data is encrypted both in transit and at rest.

• TLS 1.2+ for all data in transit, including API and browser traffic
• AES-256 encryption for data at rest across databases and object storage
• Secrets and credentials stored in a managed secrets vault, never in source code
• Encryption keys managed through a cloud key-management service with rotation

Access to customer data follows the principle of least privilege. Only the systems and personnel that require access to operate the Service can obtain it, and all access is logged.

• Role-based access control (RBAC) across the product and internal systems
• Single sign-on (SSO) and OAuth for customer authentication
• Mandatory multi-factor authentication (MFA) for all internal access
• Just-in-time, audited access to production for engineering staff
• Quarterly access reviews and prompt deprovisioning on role change or offboarding

Security is part of our software development lifecycle, not an afterthought. Changes are reviewed, tested, and scanned before they reach production.

• Mandatory peer code review before merge
• Automated dependency and vulnerability scanning in CI
• Static analysis and secret scanning on every change
• Periodic third-party penetration testing
• Tenant isolation so one customer's data is never exposed to another

We continuously monitor the platform for anomalous activity and maintain a documented incident response process.

• Centralized logging and audit trails across the stack
• Automated alerting on anomalous or unauthorized activity
• A documented incident response plan with defined roles and escalation
• Commitment to notify affected customers without undue delay in the event of a breach

We align our program with recognized security and privacy frameworks.

• CASA (Cloud Application Security Assessment) certified
• SOC 2 Type II readiness in progress
• GDPR and CCPA aligned data handling practices
• Data Processing Agreements (DPAs) available for customers on request

You own your data. We process it only to provide and improve the Service, and we never sell it. Customer data is retained for the duration of your account and deleted on request or after termination, subject to legal retention obligations. For full detail on what we collect and your rights, see our Privacy Policy.

We use a vetted set of third-party sub-processors — including cloud infrastructure, model, and analytics providers — each bound by a data processing agreement and reviewed for their own security posture. A current list of sub-processors is available on request.

We welcome reports from security researchers. If you believe you have found a vulnerability, please report it to us privately and give us a reasonable opportunity to remediate before any public disclosure. We will not pursue legal action against researchers who act in good faith and avoid privacy violations, data destruction, or service disruption.

Report a vulnerability to security@10ex.ai. For other security questions, email info@10ex.ai.