# Data Processing Addendum (DPA) — Hexes Security > Terms under which Hexes Security, Inc. processes personal data on a customer's behalf (support materials, hosted evaluations, hosted services), covering GDPR... - Canonical: https://hexessecurity.com/legal/data-processing-addendum - Last updated: 2026-11-13 - Site index for agents: https://hexessecurity.com/llms.txt _Legal_ # Hexes Data Processing Addendum Version 1.0 · Effective 2026-11-11 · Status: published **Version 1.0 · Effective date: 2026-11-11** This Data Processing Addendum (**"DPA"**) forms part of the Hexes Customer Agreement or other written agreement (the **"Agreement"**) between **Hexes Security, Inc.** and the customer named in it (**"Customer"**). It applies when Hexes Security, Inc. processes Customer Personal Data on Customer's behalf in providing the Offerings. It is incorporated into the Agreement automatically and needs no separate signature. A signed copy is available on request from legal@hexessecurity.com. ## 1. Definitions Terms not defined here have the meanings in the Agreement. - **"Data Protection Laws"**: all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (**"GDPR"**), the GDPR as retained in UK law and the UK Data Protection Act 2018 (**"UK GDPR"**), the Swiss Federal Act on Data Protection (**"FADP"**), and US state privacy laws such as the California Consumer Privacy Act as amended (**"CCPA"**). - **"Customer Personal Data"**: personal data in Customer Data that Hexes Security, Inc. processes on Customer's behalf under the Agreement. - **"Security Incident"**: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Hexes Security, Inc. or its Subprocessors. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked log-in attempts or denial-of-service attempts. - **"Subprocessor"**: a third party engaged by Hexes Security, Inc. to process Customer Personal Data. - **"SCCs"**: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. - **"UK Addendum"**: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner. - "Controller", "processor", "data subject", "personal data", "processing", "business", "service provider" and "supervisory authority" have the meanings in the Data Protection Laws. ## 2. Scope and roles **2.1 Where this DPA applies.** Hexes software that Customer runs in its own environment processes Customer Data there, under Customer's control; Hexes Security, Inc. does not process that data unless Customer sends it to Hexes Security, Inc. or connects that software to a console that Hexes Security, Inc. hosts. This DPA applies to Customer Personal Data that Hexes Security, Inc. receives or can access, such as in Support Materials, in Professional Services performed with access to Customer's systems, in Hosted Evaluations (including the data that Customer's clusters send to an evaluation console that Hexes Security, Inc. hosts), or in Cloud Services. **2.2 Roles.** Customer is the controller (or a processor acting for its own controllers) and Hexes Security, Inc. is a processor (or subprocessor) of Customer Personal Data. Hexes Security, Inc.'s processing of personal data as a controller, such as business contact data and Usage Data, is described in the Hexes Privacy Notice and is outside this DPA. **2.3 Details of processing.** The subject matter, nature, purpose, duration, and categories of data and data subjects are set out in Annex I. ## 3. Obligations of Hexes Security, Inc. **3.1 Instructions.** Hexes Security, Inc. will process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, Customer's use and configuration of the Offerings, and other reasonable written instructions consistent with them, unless processing is required by law, in which case Hexes Security, Inc. will inform Customer before processing unless the law prohibits it. Hexes Security, Inc. will tell Customer if, in its opinion, an instruction infringes Data Protection Laws. **3.2 Confidentiality.** Hexes Security, Inc. will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and have access to it only as needed for their role. **3.3 Security.** Hexes Security, Inc. will implement and maintain the technical and organizational measures in Annex II. Hexes Security, Inc. may update these measures, provided the update does not materially reduce the overall protection of Customer Personal Data. **3.4 Assistance.** Taking into account the nature of the processing, Hexes Security, Inc. will provide reasonable assistance to Customer, at Customer's reasonable cost where the assistance goes beyond the functionality of the Offerings, in responding to data subject requests, carrying out data protection impact assessments and prior consultations, and meeting Customer's security obligations. If Hexes Security, Inc. receives a request directly from a data subject about Customer Personal Data, it will refer the data subject to Customer and will not respond except to confirm the referral or as required by law. **3.5 Security Incidents.** Hexes Security, Inc. will notify Customer without undue delay and, where feasible, within 72 hours after becoming aware of a Security Incident, and will provide information reasonably available to it to help Customer meet its own notification obligations, including the nature of the incident, likely consequences and measures taken. Hexes Security, Inc. will take reasonable steps to contain, investigate and mitigate the incident. Notification is not an acknowledgment of fault or liability. **3.6 Return and deletion.** Hexes Security, Inc. retains Customer Personal Data only for as long as reasonably needed for the purposes in Annex I. Customer may at any time instruct Hexes Security, Inc. to delete or return Customer Personal Data by emailing support@hexessecurity.com, and Hexes Security, Inc. will do so within 30 days. When the Agreement ends, Hexes Security, Inc. will delete or return Customer Personal Data, at Customer's choice, on Customer's request; absent a request, Hexes Security, Inc. will delete it in accordance with its data retention practices once it is no longer needed for those purposes. Copies in backups are overwritten in the normal course of backup rotation. Where retention is required by law, or until backup copies are overwritten, Hexes Security, Inc. will continue to protect retained data under this DPA and will not actively process it. For a Hosted Evaluation, Section 8.5 of the Agreement also applies. ## 4. Subprocessors **4.1 Authorization.** Customer gives general authorization for Hexes Security, Inc. to engage Subprocessors. Annex III describes the categories of Subprocessors. The Subprocessors themselves, with their purpose, the data they process and their location, are named in the subprocessor list published at hexessecurity.com/legal/subprocessors (or a successor location), or provided on request to legal@hexessecurity.com (the **"Subprocessor List"**). **4.2 Changes.** Hexes Security, Inc. will give at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating the Subprocessor List and by email to Customer's account contacts, or by a notice in the Offerings or the customer portal. Customer may also ask to receive these notices by writing to legal@hexessecurity.com. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it, Customer may terminate the affected Offering by written notice and receive a refund of prepaid fees for the period after termination. **4.3 Flow-down.** Hexes Security, Inc. will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains liable for each Subprocessor's performance. ## 5. Audits Hexes Security, Inc. will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA. On written request, not more than once in any 12-month period (or more often where a supervisory authority requires or after a Security Incident), Hexes Security, Inc. will provide responses to reasonable security questionnaires and copies of available third-party audit reports or certifications, under confidentiality. If these do not reasonably satisfy Customer's obligations under Data Protection Laws, Customer may, at its own cost, on at least 30 days' notice, conduct an audit or have an independent auditor that is not a competitor of Hexes Security, Inc. and is bound by confidentiality conduct it, during normal business hours, in a manner that does not disrupt Hexes Security, Inc.'s operations or compromise the security or confidentiality of other customers' data. ## 6. International transfers **6.1 Transfers.** Hexes Security, Inc. may process Customer Personal Data in the United States and in other countries where Hexes Security, Inc. or its Subprocessors operate, subject to this Section 6. **6.2 EEA.** To the extent Customer Personal Data subject to GDPR is transferred to Hexes Security, Inc. in a country that does not have an adequacy decision, the SCCs are incorporated into this DPA as follows: Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor; clause 7 (docking clause) applies; under clause 9, option 2 (general authorization) applies with the notice period in Section 4.2; the optional language in clause 11 does not apply; under clauses 17 and 18, the SCCs are governed by, and disputes resolved by the courts of, Ireland; Annexes I to III of the SCCs are completed by the Annexes to this DPA. **6.3 UK.** For transfers subject to UK GDPR, the UK Addendum is incorporated and completed with the information in this DPA and its Annexes; either party may end the UK Addendum as set out in its Section 19. **6.4 Switzerland.** For transfers subject to the FADP, the SCCs apply as in Section 6.2, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and "Member State" read to include Switzerland so that data subjects in Switzerland can enforce their rights there. **6.5 Alternative mechanisms.** If Hexes Security, Inc. adopts another lawful transfer mechanism (such as certification under the EU-US Data Privacy Framework), that mechanism will apply instead to the extent it covers the transfer. **6.6 Government access.** Unless prohibited by law, Hexes Security, Inc. will notify Customer of any legally binding request by a public authority for Customer Personal Data, will challenge requests that it reasonably considers unlawful, and will disclose only the minimum required. ## 7. US state privacy laws To the extent the CCPA or similar US state laws apply, Hexes Security, Inc. acts as Customer's service provider or processor and will: (a) process Customer Personal Data only for the business purposes specified in Annex I; (b) not sell or share it (as those terms are defined in the CCPA), or retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Offerings; (c) not combine it with personal data received from other sources except as permitted by law; (d) comply with applicable obligations and provide the same level of protection required of Customer; (e) notify Customer if it can no longer meet its obligations; and (f) allow Customer to take reasonable steps to stop and remediate unauthorized use. Hexes Security, Inc. certifies that it understands and will comply with these restrictions. ## 8. Customer obligations Customer is responsible for having a lawful basis and giving any notices and obtaining any consents required for Hexes Security, Inc. to process Customer Personal Data under the Agreement, and for the accuracy of its instructions. Customer will send Hexes Security, Inc. only the Customer Personal Data needed for the purpose (for example, by masking personal data and secrets in Support Materials where practicable) and will not send special categories of personal data, protected health information or payment card data unless the parties have agreed in writing on additional terms. ## 9. Liability and precedence Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except to the extent Data Protection Laws or the SCCs provide otherwise. If this DPA conflicts with the Agreement, this DPA governs as to the processing of Customer Personal Data. If the SCCs conflict with this DPA, the SCCs govern. ## Annex I: Details of processing **Parties.** Data exporter: Customer (and its Affiliates, as applicable), contact details as in the Agreement or Order; role: controller or processor. Data importer: Hexes Security, Inc., 2261 Market Street STE 68751, San Francisco, CA 94114, USA, legal@hexessecurity.com; role: processor. **Categories of data subjects.** Customer's personnel and Authorized Users; individuals whose information appears in Customer's systems, applications and network traffic that Customer chooses to send to Hexes Security, Inc., connects to a Hosted Evaluation or processes in Cloud Services (for example, users of Customer's applications). **Categories of personal data.** Names, usernames, email addresses and other identifiers of Authorized Users; IP addresses, hostnames, device and workload identifiers; log, event, network, process and file metadata; workload, vulnerability, policy and event data from clusters that Customer connects to a Hosted Evaluation, and records of sign-ins and actions in a hosted console; names that Customer gives to its clusters; and any personal data contained in Support Materials or in Customer Data processed by Cloud Services, as determined by Customer. **Special categories.** None intended. Customer will not send special categories of data unless agreed under Section 8. **Frequency.** Continuous for Cloud Services and Hosted Evaluations; occasional for Support and Professional Services. **Nature and purpose (business purposes).** Hosting, storage, analysis and transmission to provide the Offerings, provide Support and Professional Services, maintain the security of the Offerings, fix defects using only de-identified or aggregated information, and as otherwise instructed by Customer. **Duration and retention.** For the term of the Agreement and afterwards until deleted or returned under Section 3.6; for a Hosted Evaluation, until deleted under Section 8.5 of the Agreement. **Location.** The United States, where Hexes Security, Inc.'s hosted services are currently hosted, and the locations of the Subprocessors stated in the Subprocessor List. **Competent supervisory authority.** For the SCCs, the supervisory authority determined under clause 13 of the SCCs. ## Annex II: Technical and organizational security measures 1. **Governance:** assigned responsibility for information security. 2. **Access control:** role-based access to systems that hold Customer Personal Data, limited to personnel who need it; individual accounts and sign-in to hosted services, with no shared passwords; removal of access when it is no longer needed. 3. **Encryption:** encryption in transit, using current industry-standard protocols, for connections to Hexes Security, Inc.'s hosted services. 4. **Secure development:** automated tests on every change before it is accepted, a published list of the components of each release, and digitally signed releases. 5. **Logging:** logging of sign-ins and administrative actions on the hosted services, kept for investigations. 6. **Vulnerability management:** a public vulnerability disclosure program, and security fixes delivered in Updates. 7. **Incident response:** Security Incidents are contained, investigated and notified to Customer under Section 3.5. 8. **Personnel:** confidentiality obligations for everyone with access to Customer Personal Data; access granted only to personnel who need it for their role, and removed when no longer needed. 9. **Vendors:** each Subprocessor bound by written data protection terms, as Section 4.3 requires. 10. **Data minimization:** guidance for customers on masking secrets and personal data in Support Materials; deletion of Support Materials as the Support Policy describes. 11. **Location and physical security:** hosted services are currently hosted in the United States, and physical access to the systems that hold Customer Personal Data is restricted to authorized personnel; Subprocessors that hold Customer Personal Data hold industry-recognized security certifications (such as ISO 27001 or SOC 2). 12. **Hosted evaluations:** Hexes Security, Inc. keeps each evaluation customer's data separate from other customers'. ## Annex III: Subprocessors Hexes Security, Inc.'s hosted services (the customer portal, the software distribution service and Hosted Evaluations) are currently hosted in the United States. Hexes Security, Inc. uses Subprocessors in the categories below. The Subprocessors in each category, with their purpose, the data they process and their location, are named in the Subprocessor List (Section 4.1), which changes only with the notice described in Section 4.2. | Category | Purpose | Customer Personal Data involved | | --- | --- | --- | | Content delivery and network security provider, which also provides identity and sign-in | Encrypted connections, sign-in and protection against attacks for the customer portal, the software distribution service and hosted consoles | Data in transit, including sign-in identities and the data that Authorized Users view in a hosted console | | Email service provider | Business email and file storage | Support Materials and support correspondence that Customer chooses to send by email | [All legal documents](https://hexessecurity.com/legal) --- _About Hexes Security:_ Hexes Security builds commercial cloud-workload security for Kubernetes: inline zero-trust enforcement at layer 7 — network, process and file — from policy learned from each workload (Learning → Watching → Enforcing). It extends inline enforcement to eBPF, AI-agent and MCP traffic, and the software supply chain. Hexes is not open source, not a CSPM/CIEM, not a SIEM and not a CNI.