---
icon: material/shield-lock-outline
title: "Security"
description: "Where log data goes, what a deployed engine can send to log10x, and the documents a vendor-security review asks for."
---

# Security

10x is licensed software that runs in your network. Log content moves
through your pipeline to your SIEM and never reaches log10x. A deployed
engine has two outbound calls to log10x, and as shipped it makes neither.

<div class="grid cards" markdown>

- :material-cube-outline: **[Product shape](product-shape.md)**

    What the software is, where it runs, and where log content goes.

- :material-lan-disconnect: **[Outbound](outbound.md)**

    The two calls, the three states, and what removes them.

- :material-check-decagram-outline: **[Verifying](verifying.md)**

    Falsify each state with a packet capture of your own.

- :material-table-eye: **[Telemetry](telemetry.md)**

    Every field a call can carry, typed, with a PII column.

- :material-cog-outline: **[Operations](operations.md)**

    Evaluation without an account, and how license keys are signed.

- :material-package-variant-closed-check: **[SBOM](sbom.md)**

    CycloneDX JSON per engine flavor, on every release.

</div>

Filling a SIG Lite, CAIQ or in-house questionnaire: the product answers are
on these pages, and a form on your own paper comes back completed from
[security@log10x.com](mailto:security@log10x.com).

## :material-bug-outline: Report a vulnerability

Write to [security@log10x.com](mailto:security@log10x.com), which is the
address in
[security.txt](https://www.log10x.com/.well-known/security.txt){target="_blank"}.
A first response comes within 24 hours.

| | |
|--|--|
| Remediation target, CVSS 9 and above | 48 hours |
| Remediation target, everything else | 30 days |
| Disclosure | Coordinated with the reporter, with recognition for valid findings |

Fixes ship as a new engine release, so applying one is an upgrade on your
side. Every release from 1.1.73 carries an [SBOM](sbom.md), which is what
lets you scan the artifact you run against your own advisory feed.

## :material-clipboard-text-outline: Also useful

| Resource | What it is |
|----------|------------|
| [Security FAQ](../faq/security/index.md) | The same ground in question form, including deployment models and compliance |
| [License](../manage/license.md) | How the token works, and what happens without one |