hex.tech

79 of 100

Enterprise AI readiness, from public pages only

Scanned 2026-11-01 from 100 public pages. Methodology 1.0. Category: Data.

Identity		17 of 20
Assurance		21 of 21
Data and AI terms		9 of 22
Deployment		6 of 6
Agent readiness		15 of 17

Claim this page Compare

Identity

SAML or OIDC single sign-on (10 points) Found

Hex supports integrating with SSO providers via the OpenID Connect (OIDC) protocol. source

Report a problem with this result

SCIM provisioning (6 points) Partly found

Directory sync (Enterprise only) : Integrate with your directory provider to inherit roles and groups without having to manage them directly in Hex. source

Report a problem with this result

Roles and permissions (4 points) Found

User Roles: limits what actions users can take within Hex, and also (if enabled) what role users are added to by default. source
Project owners can restrict permissions of collaborators source

Report a problem with this result

Assurance

SOC 2 Type 2 (10 points) Found

we have obtained our SOC 2 Type II report source

Report a problem with this result

ISO 27001 (4 points) Under review

Report a problem with this result

Trust center (5 points) Found

Data Security @ Hex source

Report a problem with this result

security.txt (2 points) Found

Contact: https://hackerone.com/hex source

Report a problem with this result

Public status page (2 points) Found

Hex Status source

Report a problem with this result

Bug bounty or disclosure program (2 points) Found

Report it via HackerOne . source
Hex undergoes regular penetration testing and operates a private bug bounty program . source
Contact: https://hackerone.com/hex source

Report a problem with this result

Data and AI terms

No training on customer data (8 points) Not found in public pages

Pages searched (4)

https://learn.hex.tech/docs/legal
https://learn.hex.tech/docs/legal/terms-and-conditions
https://hex.tech/careers/legal-ops/
https://hex.tech/capability/ai/

Report a problem with this result

Retention periods (5 points) Not found in public pages

Pages searched (4)

https://learn.hex.tech/docs/legal
https://learn.hex.tech/docs/legal/terms-and-conditions
https://hex.tech/careers/legal-ops/
https://hex.tech/capability/ai/

Report a problem with this result

Subprocessor list (5 points) Found

Hex's subprocessors, their purposes, and data residencies are available here: https://learn.hex.tech/docs/legal/subprocessors . source
For more information on Hex's AI providers, see Hex's Subprocessors List . source

Report a problem with this result

Data processing agreement (4 points) Found

Will enter into a DPA source
Hex may enter into Data Processing Agreements (DPAs) with customers that require additional privacy guarantees. source
Data Processing Addendum source

Report a problem with this result

Data residency (4 points) Under review

Report a problem with this result

Deployment

Private deployment (6 points) Found

Hex is deployable to a single-tenant model in a geographic region of your choosing (as long as it's supported by AWS) source

Report a problem with this result

Customer-managed keys (4 points) Under review

Report a problem with this result

Agent readiness

Public API reference (5 points) Found

Public API Reference source

Report a problem with this result

Official MCP server (6 points) Found

4.0 projects can also be created using an external agent, such as Claude, Codex, and Cursor, connected through the Hex MCP server . source
Projects can be edited within Hex's UI using the Hex agent, or via an external agent of choice connected through the Hex MCP server. source
Admins can mark data connections as Sensitive so the Hex Agent treats them carefully in Threads started from external integrations, including Slack and the Hex MCP Server . source

Report a problem with this result

Controls on AI agent actions (4 points) Found

Governed mode restricts the agent to the sources Admins choose, such as only endorsed data, semantic models only , or a custom policy. source
Admins can require Explorers to stay in Governed mode and set it as the default for new conversations. source
Admins can enable/disable this feature in workspace settings . source

Report a problem with this result

Audit log export (2 points) Could not check

The scan reached its page or time limit before reading the pages this check needs.

Report a problem with this result

AI use policy (2 points) Not found in public pages

Pages searched (20)

https://hex.tech/security/
https://hex.tech/.well-known/security.txt
https://trust.hex.tech/
https://learn.hex.tech/docs/trust/data-privacy-and-usage-faq
https://learn.hex.tech/docs/trust
https://learn.hex.tech/docs/trust/ai-data-privacy
https://learn.hex.tech/docs/legal
https://learn.hex.tech/docs/legal/terms-and-conditions
https://learn.hex.tech/tutorials/ai-best-practices/setup-for-ai-agents
https://learn.hex.tech/tutorials/ai-best-practices
https://hex.tech/blog/trust-used-to-be-implied/
https://hex.tech/blog/data-trust/
https://hex.tech/blog/security-checklist-for-data-tools/
https://hex.tech/blog/ai-analytics-trust/
https://hex.tech/blog/category/security/
https://hex.tech/resources/video/grounding-ai-in-trusted-context/
https://learn.hex.tech/tutorials/quickstart/admin-101
https://hex.tech/careers/cloud-security-engineer/
https://trust.hex.tech/
https://hex.tech/careers/legal-ops/

Report a problem with this result

Rate limits documented (not scored) Found

style="color:#393A34"><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># Rate limited: honor Retry-After if sent, else back off</span><span class="token plain"></span><br></div><div class="token-line" source
Kernel and rate limits source
If a user exceeds 60 requests in a minute, subsequent requests will be denied and return a 429 status until the rate limit is reset, 60 seconds after the first request. source

Report a problem with this result

Changelog

2026-11-01: 80 to 79 (rescan) AI use policy: Could not check to Not found in public pages; Official MCP server: Could not check to Found; Rate limits documented: Could not check to Found; Customer-managed keys: Partly found to under review; SCIM provisioning: Could not check to Partly found; ISO 27001: Could not check to under review
2026-11-01: First score, 80

Scores older than an hour can be refreshed.