hex.tech
B
79 of 100
Enterprise AI readiness, from public pages only
Scanned 2026-11-01 from 100 public pages. Methodology 1.0. Category: Data.
| Identity | 17 of 20 | |
| Assurance | 21 of 21 | |
| Data and AI terms | 9 of 22 | |
| Deployment | 6 of 6 | |
| Agent readiness | 15 of 17 |
Trend and peers iHow the score moved over the last scans, how it compares with other scored companies in the same market category, and what about the last scan means the score may still move. Everything comes from public pages.
One graded scan so far. The trend shows after the next one.
Peers
Not enough scored companies in this category yet (3 so far, 5 needed).
Likely to change iWhat about the last scan means the score may still move: checks that could not be read, findings waiting for review, an old scan, an older methodology, or a scan that hit its page limit. These describe the scan, not the company.
- 1 check could not be read at the last scan, so the score may move when it is read.
- 3 findings are waiting for staff review.
- The last scan stopped at its page limit, so some pages were not read.
Identity
SAML or OIDC single sign-on (10 points) Found
Hex supports integrating with SSO providers via the OpenID Connect (OIDC) protocol.
source
SCIM provisioning (6 points) Partly found
Directory sync (Enterprise only) : Integrate with your directory provider to inherit roles and groups without having to manage them directly in Hex.
source
Assurance
SOC 2 Type 2 (10 points) Found
we have obtained our SOC 2 Type II report
source
ISO 27001 (4 points) Under review
security.txt (2 points) Found
Contact: https://hackerone.com/hex
source
Data and AI terms
No training on customer data (8 points) Not found in public pages
Pages searched (4)
https://learn.hex.tech/docs/legalhttps://learn.hex.tech/docs/legal/terms-and-conditionshttps://hex.tech/careers/legal-ops/https://hex.tech/capability/ai/
Retention periods (5 points) Not found in public pages
Pages searched (4)
https://learn.hex.tech/docs/legalhttps://learn.hex.tech/docs/legal/terms-and-conditionshttps://hex.tech/careers/legal-ops/https://hex.tech/capability/ai/
Subprocessor list (5 points) Found
Data processing agreement (4 points) Found
Data residency (4 points) Under review
Deployment
Private deployment (6 points) Found
Hex is deployable to a single-tenant model in a geographic region of your choosing (as long as it's supported by AWS)
source
Customer-managed keys (4 points) Under review
Agent readiness
Official MCP server (6 points) Found
4.0 projects can also be created using an external agent, such as Claude, Codex, and Cursor, connected through the Hex MCP server .
sourceProjects can be edited within Hex's UI using the Hex agent, or via an external agent of choice connected through the Hex MCP server.
sourceAdmins can mark data connections as Sensitive so the Hex Agent treats them carefully in Threads started from external integrations, including Slack and the Hex MCP Server .
source
Controls on AI agent actions (4 points) Found
Governed mode restricts the agent to the sources Admins choose, such as only endorsed data, semantic models only , or a custom policy.
sourceAdmins can require Explorers to stay in Governed mode and set it as the default for new conversations.
sourceAdmins can enable/disable this feature in workspace settings .
source
Audit log export (2 points) Could not check
The scan reached its page or time limit before reading the pages this check needs.
AI use policy (2 points) Not found in public pages
Pages searched (20)
https://hex.tech/security/https://hex.tech/.well-known/security.txthttps://trust.hex.tech/https://learn.hex.tech/docs/trust/data-privacy-and-usage-faqhttps://learn.hex.tech/docs/trusthttps://learn.hex.tech/docs/trust/ai-data-privacyhttps://learn.hex.tech/docs/legalhttps://learn.hex.tech/docs/legal/terms-and-conditionshttps://learn.hex.tech/tutorials/ai-best-practices/setup-for-ai-agentshttps://learn.hex.tech/tutorials/ai-best-practiceshttps://hex.tech/blog/trust-used-to-be-implied/https://hex.tech/blog/data-trust/https://hex.tech/blog/security-checklist-for-data-tools/https://hex.tech/blog/ai-analytics-trust/https://hex.tech/blog/category/security/https://hex.tech/resources/video/grounding-ai-in-trusted-context/https://learn.hex.tech/tutorials/quickstart/admin-101https://hex.tech/careers/cloud-security-engineer/https://trust.hex.tech/https://hex.tech/careers/legal-ops/
Rate limits documented (not scored) Found
style="color:#393A34"><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># Rate limited: honor Retry-After if sent, else back off</span><span class="token plain"></span><br></div><div class="token-line"
sourceKernel and rate limits
sourceIf a user exceeds 60 requests in a minute, subsequent requests will be denied and return a 429 status until the rate limit is reset, 60 seconds after the first request.
source
Changelog
- 2026-11-01: 80 to 79 (rescan) AI use policy: Could not check to Not found in public pages; Official MCP server: Could not check to Found; Rate limits documented: Could not check to Found; Customer-managed keys: Partly found to under review; SCIM provisioning: Could not check to Partly found; ISO 27001: Could not check to under review
- 2026-11-01: First score, 80
Scores older than an hour can be refreshed.