Hexes Subprocessor List
Version 1.0 · Effective 2026-11-11 · Status: published
Version 1.0 · Effective date: 2026-11-11
This list names the subprocessors that Hexes Security, Inc. engages to process personal data on its customers' behalf ("Customer Personal Data") under the Hexes Data Processing Addendum (the "DPA"). It is the Subprocessor List referred to in Section 4 of the DPA. Capitalized terms not defined here have the meanings in the DPA and the Hexes Customer Agreement.
Hexes Security, Inc.'s hosted services (the customer portal, the software distribution service, hosted consoles and evaluation environments) are currently hosted in the United States. Software that customers run in their own environments sends Hexes Security, Inc. no Customer Data except as the Hexes Customer Agreement describes.
1. Current subprocessors
| Subprocessor | Category | Purpose | Customer Personal Data | Location |
|---|---|---|---|---|
| Cloudflare, Inc. (San Francisco, California, USA) | Content delivery and network security provider; identity and sign-in provider | Encrypted connections, sign-in and protection against attacks in front of the customer portal, the software distribution service and hosted consoles, including Hosted Evaluations | Passes through in transit: the sign-in identities of Authorized Users (such as name and email address) and the data that Authorized Users send to or view in a hosted console | United States, and the provider's data centers worldwide that carry the traffic |
| Google LLC (Mountain View, California, USA) | Email service provider | Business email and file storage | Support Materials and support correspondence that a customer chooses to send by email, including the contact details and any personal data in them | United States, and other countries where the provider operates |
2. Changes, notice and objections
- Notice. At least 30 days before a new subprocessor processes Customer Personal Data, Hexes Security, Inc. updates this list, with a new version number and effective date, and notifies customers as Section 4.2 of the DPA describes: by email to the customer's account contacts, or by a notice in the Offerings or the customer portal.
- Subscribing to notices. Anyone responsible for a customer's account can also ask to receive these notices by writing to [email protected] with "Subprocessor notices" in the subject line.
- Objections. A customer may object to a new subprocessor on reasonable data protection grounds within the notice period by writing to [email protected]. Section 4.2 of the DPA describes what happens next.
- Earlier versions of this list remain available at hexessecurity.com/legal/subprocessors.
3. Scope
This list covers processing that Hexes Security, Inc. performs as a processor for its customers. How Hexes Security, Inc. uses personal data for its own purposes, and the categories of providers it uses for that, is described in the Hexes Privacy Notice.
4. Contact
Questions: [email protected] · Hexes Security, Inc., Attn: Legal, 2261 Market Street STE 68751, San Francisco, CA 94114, USA.