Security & Compliance

Zero egress of source code and log data.
Your pipeline · Your metrics store · Air-gap supported

Your Security Review Architecture

Design Principles

Self-Hosted

Runs in your network
logs never sent to log10x

Fits Your Stack

Plugs into the pipeline
nothing new to secure or review

Change Control

The agent only proposes
the engine applies what you approve

Deployment Model

A decision layer beside your forwarder, working with your existing stack.

Logs are processed in your pipeline; log content never reaches log10x
Metrics go to the time-series DB you pick; choose the optional 10x-hosted one (for evaluation) and aggregated metrics reach log10x, with a data processing agreement available
The agent proposes config to a destination you control; the engine enforces it. The MCP server is how the agent and engine talk; dashboards are open-source Grafana imports or your platform's own

Security Review

10x is software you run, not a service that receives your data.

THE DEFAULT

Everything runs in your environment

The engine processes logs inside your pipeline
The MCP server and AI agent run in your environment
Metrics go to your own time-series DB (Prometheus, Datadog, CloudWatch, Elastic, SignalFx)
Offloaded archives live in your own S3
Air-gapped operation supported

Vendor type: software licensor. Data processor: no. DPA or BAA: not required. Your existing controls (SOC 2, HIPAA, PCI DSS) apply directly.

THE ONE OPT-IN

If you pick the 10x-hosted TSDB

During evaluation, point metrics at 10x-hosted Prometheus + Grafana instead of wiring your own TSDB
Aggregated metrics only: event counts, byte volumes, and recurring log-pattern names. Published schema, no log content, no PII
TLS 1.3 to prometheus.log10x.com (us-east-1), on AWS Managed Grafana + Prometheus (SOC 2 Type II, ISO 27001)
Metrics DPA available

In production, point metrics at your own TSDB and view them in open-source Grafana dashboards or your existing platform. Switch off hosted metrics anytime and nothing reaches log10x at all. Log content never reaches log10x in any mode.

FOR YOUR REVIEWER

Everything they need, self-serve

Software bill of materials (SBOM)
Telemetry schema: every field that can egress, typed
Agent permission model: scoped key, where changes land, read-only mode, audit trail
security.txt (RFC 9116)
SIG Lite questionnaire: security@log10x.com

log10x SOC 2 Type II is underway, expected in 2026. With the default deployment your auditors review your own controls, not log10x's certification.

security@log10x.com

Security FAQ

Does any log content leave my network, ever?

No. The engine runs inside your infrastructure, a forwarder sidecar in Receiver mode or a read-only DaemonSet in Reporter mode, so log content stays in your network in every mode and processed events go only where you route them.

In the default online mode the engine validates its license and pushes per-pattern metrics (event counts, byte volumes, and labels like app and namespace, no log content and no PII) to an endpoint that defaults to your own time-series database. Point it there or run air-gapped, and nothing reaches log10x. Tools that ingest logs into their cloud hold a copy of your log content; this architecture does not.

Data Protection FAQ

How do I prove to auditors that log content never leaves, not just take your word?

You verify it from your own side, because all processing runs in your infrastructure and log content never reaches log10x. The Reporter deploys as a read-only DaemonSet that tails the stream before ship without modifying or redirecting any data, surfacing exactly what would move before anything runs in-path.

What leaves your network is aggregated per-pattern metrics, by default to a time-series database you run, plus a lightweight license heartbeat (node ID and pipeline name, no log content and no PII); both are published as a typed schema, field by field. Air-gapped mode suppresses every outbound call.

Telemetry schema

If the agent or its API key is compromised, what is the blast radius?

Bounded by design. The agent proposes a config diff to a destination you control, and the engine, not the agent, enforces it, so a stolen key cannot drop live logs directly or exceed the engine's runtime cap.

On the GitOps path a human merges every change before it takes effect; on the un-gated ConfigMap path a write-scoped key can change pattern actions until the diff is reviewed, which is why GitOps and read-only are the recommended postures for sensitive sources. The key is scoped, per-environment, and rotatable, and setting LOG10X_MCP_READ_ONLY=true removes the write path entirely.

Agent permission model

Can I use my own model, and does it see or train on my data?

You bring your own model and key. The agent runs under your own LLM credentials, OpenAI, Anthropic, xAI, Azure OpenAI, or a self-hosted Ollama model, so inspection runs under your provider contract and inherits its governance and training terms. AI is optional and can be disabled.

Whichever model runs, it sees aggregated per-pattern metrics, plus sample lines only on an explicit pattern inspection, pulled from a source you control with your own credentials. None of it transits log10x.

Data Protection FAQ

Do I need a DPA or BAA, what is your data-processor status, and where is SOC 2?

Deployed self-managed with metrics to your own backend, log content stays in your infrastructure and never reaches log10x, so log10x acts as a software licensor, not a data processor. In that configuration no DPA or BAA is needed, and your own SOC 2, HIPAA, and PCI controls cover where logs are processed.

SOC 2 Type II is underway, expected 2026; SIG Lite responses and an SBOM with SHA256 image digests are available now. If you opt into the hosted metrics backend, log10x becomes a processor for aggregated metrics only, no log content, and a DPA and BAA are available there.

Compliance FAQ

Browse all security topics

Data Protection

Privacy, encryption, data handling

Compliance

Audits and industry standards

Authentication & Access

SSO, keys, and access control

Deployment Options

Self-managed, air-gapped, hosted metrics

Agent Operation

Agent permissions and audit trail

Explore Security FAQs

Questions About Security?

SBOM, telemetry schema, and architecture docs are self-serve. A SIG Lite questionnaire and a data processing agreement are available on request. Report a vulnerability: security@log10x.com.

Schedule a Call Self-Host Guide

Join our newsletter

Technical updates, optimization tips, and product announcements.

By subscribing you agree to with our Privacy Policy

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.