> For the complete documentation index, see [llms.txt](https://docs.11x.ai/llms.txt).
> Use it to discover all available pages before exploring further.

# Data and privacy FAQ

What data 11x processes, how it is encrypted and stored, who can access it, transcript sensitivity, CRM permission scoping, and where compliance stays with you.


Common data and privacy questions. The authoritative, current source for certifications and security documentation is the [11x trust center](https://trust.11x.ai/) - send your security team there.

## Frequently Asked Questions

<Expandable title="What data does 11x process?">
**Alice:** prospect contact and firmographic data, research context from public sources, and the content of outreach and replies. **Julian:** inbound lead data, call recordings and transcripts, chat and messaging transcripts, and qualification results. Both read and write CRM data according to the permissions you grant. See [security and data handling](/security/overview).
</Expandable>

<Expandable title="How is data encrypted?">
TLS in transit, AES-256 at rest in AWS RDS. Data resides in AWS high-security facilities with continuous monitoring.
</Expandable>

<Expandable title="What certifications does 11x hold?">
SOC 2 Type II and CASA Tier 3, plus GDPR and CCPA compliance. Reports are available on request. See [security and compliance](/help-center/overview/security-and-compliance).
</Expandable>

<Expandable title="Which data class should we be most careful with?">
Call and chat transcripts. They contain what a prospect actually said, verbatim, which may include commercial detail, personal circumstances, or information about third parties. Be deliberate about where they sync and who can read them, and avoid piping full transcripts into systems with broad internal access.
</Expandable>

<Expandable title="Can we limit what 11x can access in our CRM?">
Yes - granular read and write permissions plus custom field mapping. Grant the minimum your motion needs, and use a dedicated service account rather than personal credentials. One caveat: do not omit the Opportunity or Deal object to be cautious, because that breaks open-opportunity exclusions.
</Expandable>

<Expandable title="Where is data stored, and can we require EU-only residency?">
Data resides in AWS facilities. Region-pinning options are not published, so raise EU-only residency during procurement - it may affect tier and configuration.
</Expandable>

<Expandable title="How long is data retained?">
Retention aligns with GDPR protocols. A specific retention schedule is not published - request it via the [trust center](https://trust.11x.ai/) or your 11x representative.
</Expandable>

<Expandable title="Is there a subprocessor list?">
Subprocessors facilitate CRM and sales platform connections. Request the current list from the trust center.
</Expandable>

<Expandable title="Does 11x train AI models on our data?">
No. Per the [11x terms](https://www.11x.ai/legal/autodial-terms), you retain ownership of the data you submit. 11x receives a non-exclusive, royalty-free licence to fulfil the service, uses data only in aggregate and anonymised form, and does not train AI models on confidential information.
</Expandable>

<Expandable title="Who is responsible for consent and lawful basis?">
You are. Certifications do not transfer compliance obligations. Consent, disclosure, and lawful basis for outreach vary by jurisdiction and remain yours to establish. See [consent and calling compliance](/security/consent-and-calling-compliance).
</Expandable>

<Expandable title="What about identifying individuals from website traffic?">
Website visitor tracking is subject to privacy law that varies by jurisdiction, including consent requirements in the EU and UK. Involve whoever owns privacy compliance before enabling it - identifying individuals and then contacting them is not a GTM-team-only decision. See [website visitor tracking](/data/website-visitor-tracking).
</Expandable>

<Expandable title="How should we handle API credentials?">
Store them in a secret manager, scope them narrowly with separate keys for read-only reporting and write-capable automation, rotate on a schedule and immediately when someone with access leaves, and verify webhook signatures on every inbound request. See [webhooks and API](/integrations/webhooks).
</Expandable>

<Expandable title="Does 11x support SSO?">
Yes, on the Enterprise tier. The setup procedure and supported identity providers are not published - contact your 11x representative rather than assuming a standard SAML flow.
</Expandable>

## Next steps

<Columns cols={2}>
  <Card title="Security and data handling" icon="shield" href="/security/overview" horizontal>
    Implementation-focused reference.
  </Card>
  <Card title="Security and compliance" icon="shield-check" href="/help-center/overview/security-and-compliance" horizontal>
    For procurement and security reviews.
  </Card>
  <Card title="Consent and compliance" icon="scale" href="/security/consent-and-calling-compliance" horizontal>
    What stays your responsibility.
  </Card>
  <Card title="Trust center" icon="external-link" href="https://trust.11x.ai/" horizontal>
    Current certifications.
  </Card>
</Columns>

## Need help?

For security documentation or a subprocessor list, start at the [trust center](https://trust.11x.ai/) or email [support@11x.ai](mailto:support@11x.ai).