Privacy
The short version: what your agents did never reaches us. It is written, signed and stored inside your own environment, and Hexr has no access to it.
Last updated 22 September 2026
What your cluster sends us
A Hexr data plane runs in your cloud account, in your Kubernetes cluster. It reports to our control plane about once a minute. That report has twelve fields, and this is all of them:
| Field | What it is |
|---|---|
| cluster_id | An identifier we generated when the cluster was registered. Not a hostname, not an address. |
| license_id | Which licence this cluster runs under. |
| agent_count | How many agent workloads are ready. A number. |
| evidence_row_count_24h | How many evidence rows were written in the last 24 hours. A number, not the rows. |
| evidence_signed_count_24h | How many of those carried a signature. |
| evidence_tool_calls_24h | How many were tool calls. |
| evidence_denied_count_24h | How many of those tool calls policy refused. |
| spire_servers_ready | How many identity servers are ready. |
| spire_agents_ready | How many identity agents are ready. |
| healthy | True or false. |
| health_detail | When unhealthy, one short sentence saying which of the six failure states applies. The only one carrying numbers reads: “policy denied N of M tool calls in 24h”. |
| version | The version of the reporting component. |
Every one of those is a count, a boolean or an identifier we issued. There is no field for an agent name, a workload identity, a tool argument, a prompt, a model response, a file, a customer record or an evidence row, because we do not want them and have nowhere to put them.
What stays in your environment, permanently
Evidence rows and everything inside them: which process acted, what it reached for, whether policy allowed it, the control it maps to, the signature, the certificate chain. They are written to a database in your cluster that you own and operate. We hold no credential for it.
Your agents' prompts and model responses, the arguments they pass to tools, the records they read, and the cloud credentials they are issued. None of it is transmitted to Hexr in any form, summarised or otherwise.
When an auditor needs evidence, a human in your organisation exports it and hands it over. That export is a file. It does not pass through us.
What this website collects
If you submit the form, your email address. It reaches a notification mailbox we read, and a waitlist record on our own API. We use it to reply to you and to tell you when something is ready. We do not sell it, and we do not send it to an advertising network.
That form is protected by Cloudflare Turnstile, which checks that you are a person rather than a script. We use Vercel Analytics for page counts.
Loading this site sets no cookies from us, and there are no advertising or session-replay trackers on it. You can confirm that from your browser's network tab, which is a better proof than this sentence.
The demo console at demo.hexr.dev is read-only and needs no account. It shows Hexr's own demonstration tenants, never another customer's data.
Who else is involved
Vercel hosts this website. Cloudflare provides DNS, the human check on the form, and video hosting. Resend delivers the notification email when you sign up. Google Cloud hosts our control plane, which holds licences and the heartbeat fields listed above.
None of them receives your agents' evidence, because we do not receive it either.
Keeping and deleting
We keep your email until you ask us to remove it. We keep heartbeat records for as long as the licence they belong to is active, because they are how we tell whether your deployment is healthy and what you are licensed for. Ask and we will delete both, and tell you when it is done.
Write to [email protected] for anything on this page, including a copy of what we hold about you.
Who we are
Hexr is a product of Cognilogue LLC, a California limited liability company. Where this page says “we”, that is the company responsible for the data described here.
If this page and the product disagree
The product is right and this page is a bug. Tell us and we will fix the page the same day. The field list above is generated from the same structure the reporting component uses, and it is checked whenever that structure changes.
