Privacy

Our role

10ETLabs Inc. is the controller for account, contact, and marketing data: the people who sign in, are invited as members, or ask sales to get in touch. For the cloud metadata a scan collects from your accounts, 10ETLabs acts as a processor on your behalf, under the data processing agreement (DPA) that accompanies your order form. We do not sell customer data. Product inventory of what a scan writes is on Trust.

Tenant content

Asset metadata, findings, membership, encrypted connection secrets, and Ask 10ET assistant chat history (your questions and the answers) are stored to provide the service. We do not store disk images, object payloads, or packet captures in this release.

Credentials

Secrets pasted in Connections are encrypted at rest with AES-256-GCM, using a key held in the platform’s secret store. There is no UI or API path that returns plaintext credentials to anyone, including 10ETLabs operators. Support impersonation is read-only and audited. The credentials you provide are for read-only roles that you can revoke at any time. 10ETLabs changes nothing in your clouds unless you deploy a separate, optional remediator role and an Owner or Admin approves a specific one-click fix.

Leads and accounts

Demo and contact forms store work email, company, and clouds so sales can reply. Workspace emails exist so owners can invite and remove members. Ask privacy@10etlabs.com to delete a lead or a tenant.

Subprocessors

These third parties process data so we can deliver the service:

• Infrastructure provider — hosts the application, database, and job queues. Our infrastructure provider is named in your order form / DPA.
• OpenAI — only when the AI assistant (Ask 10ET) is enabled for your tenant. When you ask a question or request an AI-drafted remediation, we send the question together with relevant tenant context: finding titles, severities, resource names and identifiers, remediation text, asset names and counts, and attack-path summaries. Connection secrets are never sent. OpenAI’s API data-usage policy states API data is not used to train models by default. When the assistant is not enabled, answers are generated inside the platform and nothing is sent to OpenAI.
• Email delivery provider — sends invites, password resets, and the notifications you configure. It receives recipient addresses and message content. Named in your DPA.

Contact

privacy@10etlabs.com. This page is not a substitute for a signed DPA. Your DPA comes with your order form; ask legal@10etlabs.com for a copy.