Security and data handling
The technical view of 11x security - certifications, encryption, what data each worker processes, least-privilege CRM scoping, credential handling, and your responsibilities.
11x holds SOC 2 Type II and CASA Tier 3 certification and complies with GDPR and CCPA. Data in transit is protected with TLS; data at rest is encrypted with AES-256 in AWS RDS. This page covers what that means when you're configuring the platform — for a procurement-facing summary, see security and compliance.
The 11x trust center is the authoritative, current source for certifications and security documentation. This page is about implementation decisions.
Platform controls
| Control | Implementation |
|---|---|
| Certifications | SOC 2 Type II; CASA Tier 3 |
| Regulatory | GDPR, CCPA |
| Encryption in transit | TLS |
| Encryption at rest | AES-256 in AWS RDS |
| Hosting | AWS high-security facilities, continuous monitoring |
| Redundancy | Fault-tolerant, clustered databases |
| Subprocessors | Facilitate Salesforce and other sales platform connections |
| Enterprise only | SSO, custom DPA, custom SLA, custom integrations |
What each worker processes
Knowing this is what lets you scope permissions sensibly.
- Inbound lead data from forms, chat, and calls
- Call recordings and transcripts
- Chat, SMS, and WhatsApp transcripts
- Qualification results and scoring reasoning
- CRM data you grant access to
Transcripts are the most sensitive data class here. They contain what a prospect actually said, verbatim — which may include commercial detail, personal circumstances, or information about third parties. Treat them accordingly when deciding where they sync and who can read them.
Least-privilege CRM scoping
You control what 11x can reach through granular read and write permissions and custom field mapping. Grant the minimum your motion needs.
Use a dedicated service account
Not an individual's credentials. Personal credentials break when someone changes role and are harder to audit.
Grant only the objects your motion uses
Typically Account/Company, Contact, Lead, Opportunity, and activity objects.
Don't omit Opportunity to be cautious
It feels like tightening, but it breaks open-opportunity exclusions — which means contacting accounts reps are working. Security and correctness point the same way here.
Use dedicated custom fields for 11x output
Rather than granting write access to existing business-critical fields.
Review access when your team changes
Both 11x users and the CRM service account's permission set.
Detail: Salesforce · HubSpot
API credentials
- Store in a secret manager. Never in source control or client-side code.
- Scope narrowly — separate keys for read-only reporting and write-capable automation.
- Rotate on a schedule, and immediately when someone with access leaves.
- Restrict by IP where your environment supports it.
- Verify webhook signatures on every inbound request. An unauthenticated webhook endpoint is an open write path into your systems.
- Don't log full payloads containing personal data into systems with broad internal access.
See webhooks and API.
Shared responsibility
| 11x owns | You own |
|---|---|
| Platform certifications and audits | Consent and disclosure configuration |
| Encryption in transit and at rest | CRM permission scoping |
| Infrastructure security and monitoring | API credential handling |
| Subprocessor management | User access management |
| Availability and redundancy | Lawful basis for outreach in your markets |
Consent, disclosure, and lawful basis are entirely yours and vary by jurisdiction. Certifications do not transfer compliance obligations. See consent and calling compliance.
Data residency and retention
Data resides in AWS facilities. Retention aligns with GDPR protocols.
11x does not publish a specific retention schedule or region-pinning options. If you have EU-only residency requirements or a defined retention obligation, raise it during procurement — it may affect tier and configuration. Request specifics via the trust center.
Not yet documented
SSO and SCIM configuration steps are not published. SSO is an Enterprise capability, but the setup procedure, supported identity providers, and whether SCIM provisioning is available are not documented publicly. Contact your 11x representative rather than assuming a standard SAML flow.