Data Security @ Hex

Hex is built on industry-leading security and privacy standards that keep our customer's data secure while connecting, querying, analyzing, and sharing. Hex is committed to helping customers of all sizes meet their data protection and compliance requirements.

As evidence of this, we have obtained our SOC 2 Type II report, which attests to the effectiveness and our adherence to security controls and processes.

Data Security is essential to our work

Hex has created a security-first company culture that begins at employee onboarding and expects accountability in our obligation to ensure customer data security and privacy protection. Employees are required to attend data security classes and adhere to policies required to maintain our independent third-party certifications and attestations. Hex undergoes regular penetration testing and operates a private bug bounty program.

Your data, temporary by design, secure everywhere

With Hex, your analysis is powered by live queries against your database, and data applications are shared securely without ever giving access to underlying data. No more extracting data to notebooks, .csv, and Excel files, proprietary third-party databases, or desktops. This is a distinguishing feature of Hex; minimizing data movement and restricting data access to a need-to-know basis.

Data in Hex projects are ephemeral by design, ensuring that your data is short-lived in the kernel memory. Hex's configurable caching layer gives full control over the query cost to your data warehouse cost without the sacrifice of storing data long-term.

Architecture

Hex's data workspace is built from the ground up with security in mind. Data warehouse credentials are stored securely in a vault, encrypted at rest. Hex queries your data warehouse to answer questions, returns the result to an isolated kernel, then optionally caches the result.

Workspace administrators have control over what users have access to and can restrict access to databases, and the ability to view or edit projects.

Product Access Controls

Hex supports SSO (Google Apps, Okta, and OIDC).

Hex's approach to data access is especially valuable for companies with GDPR or other privacy considerations and in sectors with specific security requirements.

Hex has a comprehensive control structure, which breaks down into three main categories:

1. User Roles: limits what actions users can take within Hex, and also (if enabled) what role users are added to by default.
2. Data Access: limits what data connections are shared with the organization. Access can be restricted to allow editors to only use provided database credentials or connections shared with them.
3. Project Access: project owners can restrict permissions of collaborators, controlling access to underlying data, app logic, and the data app itself.

Deployment options

For customers who need to meet specific regulations or privacy considerations, Hex is deployable to a single-tenant model in a geographic region of your choosing (as long as it’s supported by AWS), guaranteeing exclusive access to Hex resources.

Data Security Policy

What data does Hex store?

Hex uses AWS for data processing and storage. Data at-rest and in-transit are fully encrypted. Hex uses AES 256-bit encryption to secure data at-rest, such as database credentials, file uploads, and cached query results. Hex uses TLS v1.2 or newer to encrypt data in-transit, such as network traffic between Hex's servers and between Hex and user's browsers.

Internal Access Controls

Hex adheres to the principle of least privilege: the only personnel who can access your data are engineers and support staff that require access to perform their duties, and direct data access is only allowed in response to a customer issue. Customer Data access is logged.

Hex centrally manages internal identities via an identity provider (IdP), authentication via an single sign-on (SSO) platform where possible, and authorization via infrastructure-as-code (IaC) where applicable. Access to production systems and Customer Data is centralized, protected by multi-factor authentication (MFA), and any access control changes require peer review before being deployed.

Data Use

Our customers' data is their data. We don't sell, access, or use it for anything, ever, aside from improving our product and supporting users.

Application security

Hex utilizes software composition analysis (SCA) and static application security testing (SAST) to find vulnerabilities in first-party code and third-party dependencies. Pull Requests are automatically tested for breakage, vulnerabilities, and other code quality issues. Production code repositories use branch protections to require multiple reviewers before changes are deployed. Production changes are deployed via deployment pipelines. Hex engineers monitor a variety of system health metrics to ensure that the change has had no negative impacts on the system as a whole.