Skip to main content

​
Your cluster. Your data.

Hexr is not a SaaS platform you send data to. Everything — agent pods, evidence Postgres, policy engine, identity server — runs inside your own Kubernetes cluster. You deploy it with Helm. You own the storage. Your auditors can point at your own infrastructure. The only thing Hexr operates is a lightweight licensing endpoint: api.hexr.cloud/v1/heartbeat. Your cluster sends 5 small integers to it every 60 seconds (agent count, evidence row count, license ID, version). That is the complete outbound surface. No evidence, no credentials, no PII ever leaves your VPC. Hexr runs on AWS EKS · GCP GKE · Azure AKS · on-premises Kubernetes.

​
Choosing how to root your PKI

The only meaningful choice in a Hexr deployment is who signs the intermediate CA certificate inside your cluster. Everything else — agent code, Helm chart, SDK, evidence schema — is identical regardless.

Hexr-managed PKI

Hexr’s control plane acts as the upstream certificate authority. Your cluster’s SPIRE Server gets an intermediate CA signed by Hexr’s root. Nothing to configure on your side.Good fit for: Teams without an existing PKI who want to be in production quickly. Requires outbound access to api.hexr.cloud.

Bring your own Vault PKI

Your HashiCorp Vault PKI backend becomes the intermediate CA. Per-process identities are minted entirely inside your VPC — Hexr’s control plane never touches your signing root.Good fit for: Healthcare (HIPAA BAA), financial services, or any deployment where your security team owns the signing chain.
Air-gapped operation is on the roadmap, not generally available. The chart supports cloud.enabled=false and an offline license, but in-cluster signature-pack delivery is not yet built, so an air-gapped cluster cannot receive framework-signature updates. If you need a fully disconnected deployment for FedRAMP IL5, ITAR or CMMC Level 3, talk to us and we will scope it with you rather than point you at a guide.

​
Comparison

​
What deploys into your cluster

Every deployment installs the same Helm chart into the hexr-system namespace:

​
Next steps

Self-Hosted Quickstart

Up and running on EKS, GKE, or AKS in under an hour.

BYO Vault Setup

Configure HashiCorp Vault as your intermediate CA.

Per-Process Identity

How every agent and sub-agent gets its own attested SPIFFE ID.

Book an Auditor Demo

See Hexr running live with BYO Vault on AKS.