Privacy Policy

How 10X Connect collects, uses, and protects your data.

Effective date: June 20, 2026 · Last updated: June 20, 2026

1 · Who we are

10X Connect is operated by 10X Systems Inc. ("10X," "we," "our"), headquartered at 1901 N Roselle Rd, Suite 855, Schaumburg, IL 60195. We are a Triple-ISO-certified outsourced accounting firm (ISO 9001 Quality, ISO 27001 Information Security, ISO 22301 Business Continuity), audited annually by an independent third party.

2 · What data we collect

2.1 · Account data you give us directly

• Name, email address, role (accountant staff / client)
• Password (stored as a bcrypt hash — we never see your plaintext password)
• Time-based one-time password (TOTP) secret for two-factor authentication
• Optional: client company legal name, EIN, industry, contact info

2.2 · QuickBooks data, accessed via Intuit's authorized API

When you (or your accountant) connects your QuickBooks Online account via Intuit's standard OAuth flow, we receive an access token that lets us read the following from your books:

• Company information (name, address, fiscal year)
• Chart of Accounts
• Transactions: bills, expenses, journal entries, transfers, deposits, invoices
• Vendor and customer records
• Report data (Profit & Loss, Balance Sheet, Transaction List)

We only read data unless you explicitly authorize a write-back (for example, when you categorize an uncategorized transaction and approve the change). All write-backs are logged in your audit trail.

2.3 · Operational data we generate automatically

• Login timestamps, IP addresses, and user-agent strings (for security auditing)
• Action audit log — every change to data, who made it, when
• Comments you or your accountant leave on transactions

3 · How we use your data

We use your data only to deliver the service you signed up for:

• Authenticate you and your team
• Sync and triage uncategorized transactions from your QuickBooks file
• Generate reports and dashboards your accountant uses to close your books
• Maintain an audit trail for compliance
• Communicate with you about your account (e.g., notifying you of a stuck transaction)

We do not sell your data, share it with advertisers, use it to train AI models, or use it for any purpose unrelated to providing the 10X Connect service.

4 · How we protect your data

• Encryption in transit: All connections use TLS 1.2 or higher. Communication with Intuit's API uses HTTPS exclusively.
• Encryption at rest: QuickBooks OAuth refresh tokens and any other secrets are encrypted using AES-256-GCM before being written to the database. The encryption key is stored in an environment variable, never in source code.
• Password storage: Passwords are hashed with bcrypt at cost factor 12. We cannot recover or read your password.
• Two-factor authentication: TOTP-based 2FA is required for all accounts.
• Access controls: 10X staff access to your data is role-gated and audit-logged. Clients only ever see their own company's data.
• ISO 27001:2022: Our information security management system is independently audited annually.

5 · Data retention

• Account data: retained for the life of your account, plus 90 days after account closure for audit purposes (then deleted).
• QuickBooks data we sync: cached as long as your QBO connection is active, refreshed automatically.
• OAuth tokens: stored encrypted; rotated automatically per Intuit's refresh schedule; deleted immediately on disconnect.
• Audit log: retained for 7 years (required for SOX-aligned bookkeeping standards).

6 · Your rights and choices

• Disconnect QuickBooks: Visit your dashboard → Clients → your company → Disconnect. This revokes our OAuth token with Intuit and stops all data syncing within seconds. You can also disconnect from inside QuickBooks (Apps → 10X Connect → Disconnect).
• Delete your data: Email privacy@the10xaccountant.com from your registered address. We delete within 30 days, except where retention is required by law (audit log).
• Export your data: You can download a JSON export of your account from your profile page at any time.
• Access & correction: Update your profile data anytime. Email us for help with anything you can't change yourself.
• CCPA / GDPR rights: California and EU/UK residents have additional rights including data portability and the right to be forgotten. Email privacy@the10xaccountant.com to exercise them.

7 · Third-party services we use

• Intuit (QuickBooks Online API) — the only third party we share your QBO data with is Intuit, and only to read your books back. Intuit's privacy policy applies to data they hold: intuit.com/privacy/statement.
• Render (hosting) — our infrastructure provider. SOC 2 Type II certified. render.com/privacy.
• Cloudflare (DNS and edge SSL) — routes traffic to our servers; does not see decrypted application data.

We do not use third-party analytics (no Google Analytics, no Mixpanel, no Segment, no Facebook Pixel) on the application itself. The marketing website at the10xaccountant.com uses standard analytics — see its separate privacy policy.

8 · Children

10X Connect is a business tool. We do not knowingly collect data from anyone under 18.

9 · Changes to this policy

If we change this policy materially, we will email registered users at least 14 days before the change takes effect. The "Last updated" date at the top always reflects the most recent revision.

10 · Contact us

Privacy questions: privacy@the10xaccountant.com
Security disclosures: security@the10xaccountant.com
Mailing: 10X Systems Inc., 1901 N Roselle Rd, Suite 855, Schaumburg, IL 60195