# Subprocessors — Hexes Security

> The subprocessors that Hexes Security, Inc. engages to process personal data on its customers' behalf under the Hexes Data Processing Addendum, and how custo...

- Canonical: https://hexessecurity.com/legal/subprocessors
- Last updated: 2026-11-13
- Site index for agents: https://hexessecurity.com/llms.txt

_Legal_

# Hexes Subprocessor List

Version 1.0 · Effective 2026-11-11 · Status: published

**Version 1.0 · Effective date: 2026-11-11**

This list names the subprocessors that **Hexes Security, Inc.** engages to process personal data on its customers' behalf (**"Customer Personal Data"**) under the Hexes Data Processing Addendum (the **"DPA"**). It is the Subprocessor List referred to in Section 4 of the DPA. Capitalized terms not defined here have the meanings in the DPA and the Hexes Customer Agreement.

Hexes Security, Inc.'s hosted services (the customer portal, the software distribution service, hosted consoles and evaluation environments) are currently hosted in the United States. Software that customers run in their own environments sends Hexes Security, Inc. no Customer Data except as the Hexes Customer Agreement describes.

## 1. Current subprocessors

| Subprocessor | Category | Purpose | Customer Personal Data | Location |
| --- | --- | --- | --- | --- |
| Cloudflare, Inc. (San Francisco, California, USA) | Content delivery and network security provider; identity and sign-in provider | Encrypted connections, sign-in and protection against attacks in front of the customer portal, the software distribution service and hosted consoles, including Hosted Evaluations | Passes through in transit: the sign-in identities of Authorized Users (such as name and email address) and the data that Authorized Users send to or view in a hosted console | United States, and the provider's data centers worldwide that carry the traffic |
| Google LLC (Mountain View, California, USA) | Email service provider | Business email and file storage | Support Materials and support correspondence that a customer chooses to send by email, including the contact details and any personal data in them | United States, and other countries where the provider operates |

## 2. Changes, notice and objections

- **Notice.** At least 30 days before a new subprocessor processes Customer Personal Data, Hexes Security, Inc. updates this list, with a new version number and effective date, and notifies customers as Section 4.2 of the DPA describes: by email to the customer's account contacts, or by a notice in the Offerings or the customer portal.
- **Subscribing to notices.** Anyone responsible for a customer's account can also ask to receive these notices by writing to legal@hexessecurity.com with "Subprocessor notices" in the subject line.
- **Objections.** A customer may object to a new subprocessor on reasonable data protection grounds within the notice period by writing to legal@hexessecurity.com. Section 4.2 of the DPA describes what happens next.
- **Earlier versions** of this list remain available at hexessecurity.com/legal/subprocessors.

## 3. Scope

This list covers processing that Hexes Security, Inc. performs as a processor for its customers. How Hexes Security, Inc. uses personal data for its own purposes, and the categories of providers it uses for that, is described in the Hexes Privacy Notice.

## 4. Contact

Questions: legal@hexessecurity.com · Hexes Security, Inc., Attn: Legal, 2261 Market Street STE 68751, San Francisco, CA 94114, USA.

[All legal documents](https://hexessecurity.com/legal)

---

_About Hexes Security:_ Hexes Security builds commercial cloud-workload security for Kubernetes: inline zero-trust enforcement at layer 7 — network, process and file — from policy learned from each workload (Learning → Watching → Enforcing). It extends inline enforcement to eBPF, AI-agent and MCP traffic, and the software supply chain. Hexes is not open source, not a CSPM/CIEM, not a SIEM and not a CNI.