> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Models

> Hexr runs entirely in your Kubernetes cluster. Your data never leaves your infrastructure — choose how you want to root your PKI.

## Your cluster. Your data.

Hexr is not a SaaS platform you send data to. Everything — agent pods, evidence Postgres, policy engine, identity server — runs inside your own Kubernetes cluster. You deploy it with Helm. You own the storage. Your auditors can point at your own infrastructure.

The only thing Hexr operates is a lightweight licensing endpoint: `api.hexr.cloud/v1/heartbeat`. Your cluster sends 5 small integers to it every 60 seconds (agent count, evidence row count, license ID, version). That is the complete outbound surface. No evidence, no credentials, no PII ever leaves your VPC.

Hexr runs on **AWS EKS · GCP GKE · Azure AKS · on-premises Kubernetes**.

```bash theme={null}
helm install hexr-runtime hexr/hexr-runtime \
  -n hexr-system \
  -f values.yaml
```

***

## Choosing how to root your PKI

The only meaningful choice in a Hexr deployment is **who signs the intermediate CA certificate** inside your cluster. Everything else — agent code, Helm chart, SDK, evidence schema — is identical regardless.

<CardGroup cols={2}>
  <Card title="Hexr-managed PKI" icon="fingerprint">
    Hexr's control plane acts as the upstream certificate authority. Your cluster's SPIRE Server gets an intermediate CA signed by Hexr's root. Nothing to configure on your side.

    **Good fit for:** Teams without an existing PKI who want to be in production quickly. Requires outbound access to `api.hexr.cloud`.
  </Card>

  <Card title="Bring your own Vault PKI" icon="lock">
    Your HashiCorp Vault PKI backend becomes the intermediate CA. Per-process identities are minted entirely inside your VPC — Hexr's control plane never touches your signing root.

    **Good fit for:** Healthcare (HIPAA BAA), financial services, or any deployment where your security team owns the signing chain.
  </Card>
</CardGroup>

<Card title="Fully air-gapped" icon="shield-halved" href="/self-hosted/air-gapped">
  No outbound connectivity at all — not even the heartbeat. Container images are pre-loaded from your internal registry. License is validated offline via JWT. Your root CA, your network, zero Hexr egress.

  **Required for:** FedRAMP IL5, ITAR, CMMC Level 3, or any environment with strict network egress controls.
</Card>

***

## Comparison

|                                   | Hexr-managed PKI | BYO Vault PKI        | Air-gapped    |
| --------------------------------- | ---------------- | -------------------- | ------------- |
| **Who signs the intermediate CA** | Hexr             | Your HashiCorp Vault | Your root CA  |
| **Outbound to `api.hexr.cloud`**  | Heartbeat only   | Heartbeat only       | ❌ None        |
| **Evidence location**             | Your Postgres    | Your Postgres        | Your Postgres |
| **HIPAA BAA**                     | ✅                | ✅                    | ✅             |
| **FedRAMP IL5 / CMMC L3**         | Case-by-case     | ✅                    | ✅             |
| **Typical setup time**            | \~1 hour         | \~2 hours            | \~4 hours     |

***

## What deploys into your cluster

Every deployment installs the same Helm chart into the `hexr-system` namespace:

| Component                | What it does                                                                  |
| ------------------------ | ----------------------------------------------------------------------------- |
| **SPIRE Server + Agent** | Issues per-process cryptographic identities (SVIDs)                           |
| **DaemonSet (hostPID)**  | Attests every subprocess on every node — not just pods                        |
| **Auto-Registrar**       | Watches for pods labeled `hexr.io/*`, creates SPIRE entries automatically     |
| **Credential Injector**  | Exchanges a process SVID for real cloud credentials (AWS STS, GCP WIF, Azure) |
| **Hexr Vault**           | Secret storage backed by your Postgres, encrypted per-SVID                    |
| **Gateway**              | OpenAPI → MCP adapter with credential injection                               |
| **A2A Sidecar**          | Agent-to-agent communication over SPIFFE mTLS                                 |
| **Evidence API**         | Writes signed, control-mapped evidence rows to your Postgres                  |
| **OPA**                  | Policy sidecar — fail-closed, evaluated per process per call                  |
| **OTel Collector**       | Feeds your existing Prometheus / Jaeger / Grafana stack                       |
| **Envoy**                | mTLS sidecar in every agent pod                                               |

***

## Next steps

<CardGroup cols={2}>
  <Card title="Self-Hosted Quickstart" icon="server" href="/self-hosted/quickstart">
    Up and running on EKS, GKE, or AKS in under an hour.
  </Card>

  <Card title="BYO Vault Setup" icon="lock" href="/self-hosted/helm">
    Configure HashiCorp Vault as your intermediate CA.
  </Card>

  <Card title="Air-Gapped Guide" icon="shield-halved" href="/self-hosted/air-gapped">
    Zero-egress deployment for FedRAMP and CMMC environments.
  </Card>

  <Card title="Book an Auditor Demo" icon="calendar" href="https://hexr.dev#cta">
    See Hexr running live with BYO Vault on AKS.
  </Card>
</CardGroup>