Hexes Security
Try it out
Legal

Hexes Open Source and Third-Party Notice

Version 1.0 · Effective 2026-11-11 · Status: published

Version 1.0 · Effective date: 2026-11-11

Hexes products are proprietary commercial software from Hexes Security, Inc. Hexes products are not open source. Like almost all modern software, our products include open-source and other third-party components, which remain under their own licenses. This notice explains how we use them, how we disclose their licenses, and what stays proprietary.

1. What is open source and what is not

  • Hexes Security, Inc.'s own software is proprietary. Our code, including our changes to and additions on top of open-source components, and our policies, rule sets, configurations and content, are owned by Hexes Security, Inc. We do not publish them, and they are licensed only under the Hexes Customer Agreement, in object-code form.
  • Open-source components keep their own licenses. Each one is licensed by its authors under its own license (for example Apache-2.0, MIT, BSD or MPL). Those licenses govern those components only; they do not extend to Hexes Security, Inc.'s proprietary code, and using them does not make Hexes products open source.
  • Your rights under open-source licenses are preserved. Nothing in our commercial agreements limits the rights an open-source license gives you for the component it covers.

2. How we keep it clean

  • License review: we review the license of every component before it ships. We use components only in ways that keep Hexes Security, Inc.'s proprietary code proprietary.
  • Notices: we keep license texts and copyright notices intact, and mark files we have changed where a license requires it.
  • Disclosure: with every release we publish the list of open-source components, their versions and their licenses (the "Notices"), together with a machine-readable list of the release's components (a software bill of materials).

3. Where to find the Notices

  • In the product: each software image of the product includes the notice file and the license texts.
  • Online: hexessecurity.com/legal/open-source, listed by release.
  • With each release: the notice file, the full license texts, the component list and the software bill of materials.

4. Source code of open-source components

If the license of a specific open-source component in our products requires us to make that component's source code available (for example, some GNU or Mozilla licenses), we will provide the source code of that component, including any changes to it that the license covers. This includes the operating-system packages in our product images that are under GNU licenses: the Notices of each release list every such package together with its source package, and this offer covers each of them. We will do so for at least three years after we last distribute the relevant release, for a charge no more than our cost of physically performing the distribution. Write to [email protected], quoting the product, version and component.

This applies only to those open-source components. It does not apply to Hexes Security, Inc.'s proprietary code, which we do not disclose.

5. Engine credit

The Hexes enforcement engine builds on the NeuVector open-source project, licensed under the Apache License, Version 2.0. The Apache License does not require us to publish our own changes or additions, which are proprietary to Hexes Security, Inc. We follow its terms: its license text and copyright notices are retained, files we changed are marked, and its attribution is reproduced in the notice file that is part of the Notices. NeuVector is a trademark of SUSE. Hexes Security, Inc. is an independent company, and Hexes is its own product; neither is affiliated with, sponsored by or endorsed by SUSE.

6. Vulnerability data

The vulnerability database that Hexes Security, Inc. builds and ships with its products is compiled from public sources, including the US National Vulnerability Database (NVD), public open-source vulnerability databases and the security trackers of operating system distributions. Each source makes its data available under its own terms; where those terms require attribution or a notice, we include it in the Notices with the database. This product uses data from the NVD API but is not endorsed or certified by the NVD. Naming a source does not imply that its publisher endorses or is affiliated with Hexes Security, Inc. Vulnerability data is provided as described in the Hexes Customer Agreement and may be incomplete or out of date.

7. Contact

Questions about licensing or components: [email protected].

All legal documents