Deployment Models

Your cluster. Your data.

Hexr is not a SaaS platform you send data to. Everything — agent pods, evidence Postgres, policy engine, identity server — runs inside your own Kubernetes cluster. You deploy it with Helm. You own the storage. Your auditors can point at your own infrastructure. The only thing Hexr operates is a lightweight licensing endpoint: api.hexr.cloud/v1/heartbeat. Your cluster sends 5 small integers to it every 60 seconds (agent count, evidence row count, license ID, version). That is the complete outbound surface. No evidence, no credentials, no PII ever leaves your VPC. Hexr runs on AWS EKS · GCP GKE · Azure AKS · on-premises Kubernetes.

helm install hexr-runtime hexr/hexr-runtime \
  -n hexr-system \
  -f values.yaml

Choosing how to root your PKI

The only meaningful choice in a Hexr deployment is who signs the intermediate CA certificate inside your cluster. Everything else — agent code, Helm chart, SDK, evidence schema — is identical regardless.

Hexr-managed PKI

Hexr’s control plane acts as the upstream certificate authority. Your cluster’s SPIRE Server gets an intermediate CA signed by Hexr’s root. Nothing to configure on your side.Good fit for: Teams without an existing PKI who want to be in production quickly. Requires outbound access to api.hexr.cloud.

Bring your own Vault PKI

Your HashiCorp Vault PKI backend becomes the intermediate CA. Per-process identities are minted entirely inside your VPC — Hexr’s control plane never touches your signing root.Good fit for: Healthcare (HIPAA BAA), financial services, or any deployment where your security team owns the signing chain.

Fully air-gapped

No outbound connectivity at all — not even the heartbeat. Container images are pre-loaded from your internal registry. License is validated offline via JWT. Your root CA, your network, zero Hexr egress.Required for: FedRAMP IL5, ITAR, CMMC Level 3, or any environment with strict network egress controls.

Comparison

	Hexr-managed PKI	BYO Vault PKI	Air-gapped
Who signs the intermediate CA	Hexr	Your HashiCorp Vault	Your root CA
Outbound to `api.hexr.cloud`	Heartbeat only	Heartbeat only	❌ None
Evidence location	Your Postgres	Your Postgres	Your Postgres
HIPAA BAA	✅	✅	✅
FedRAMP IL5 / CMMC L3	Case-by-case	✅	✅
Typical setup time	~1 hour	~2 hours	~4 hours

What deploys into your cluster

Every deployment installs the same Helm chart into the hexr-system namespace:

Component	What it does
SPIRE Server + Agent	Issues per-process cryptographic identities (SVIDs)
DaemonSet (hostPID)	Attests every subprocess on every node — not just pods
Auto-Registrar	Watches for pods labeled `hexr.io/*`, creates SPIRE entries automatically
Credential Injector	Exchanges a process SVID for real cloud credentials (AWS STS, GCP WIF, Azure)
Hexr Vault	Secret storage backed by your Postgres, encrypted per-SVID
Gateway	OpenAPI → MCP adapter with credential injection
A2A Sidecar	Agent-to-agent communication over SPIFFE mTLS
Evidence API	Writes signed, control-mapped evidence rows to your Postgres
OPA	Policy sidecar — fail-closed, evaluated per process per call
OTel Collector	Feeds your existing Prometheus / Jaeger / Grafana stack
Envoy	mTLS sidecar in every agent pod

Next steps

Self-Hosted Quickstart

Up and running on EKS, GKE, or AKS in under an hour.

BYO Vault Setup

Configure HashiCorp Vault as your intermediate CA.

Air-Gapped Guide

Zero-egress deployment for FedRAMP and CMMC environments.

Book an Auditor Demo

See Hexr running live with BYO Vault on AKS.

Getting Started

Self-Hosted Deployment

Architecture

Security & Compliance

Deployment Models

Your cluster. Your data.

Choosing how to root your PKI

Hexr-managed PKI

Bring your own Vault PKI

Fully air-gapped

Comparison

What deploys into your cluster

Next steps

Self-Hosted Quickstart

BYO Vault Setup

Air-Gapped Guide

Book an Auditor Demo

​Your cluster. Your data.

​Choosing how to root your PKI

Hexr-managed PKI

Bring your own Vault PKI

Fully air-gapped

​Comparison

​What deploys into your cluster

​Next steps

Self-Hosted Quickstart

BYO Vault Setup

Air-Gapped Guide

Book an Auditor Demo

Your cluster. Your data.

Choosing how to root your PKI

Comparison

What deploys into your cluster

Next steps