Trust & Security
Hexis is a governance platform — we take our own data governance seriously. This page describes where your data lives, how it is protected, and what happens when AI processes it.
All Hexis platform data is stored in the European Union. We use Supabase as our infrastructure provider, deployed in the Frankfurt (eu-central-1) region.
Hexis uses the Anthropic Claude API to provide AI-powered compliance guidance. Here is exactly what happens with your data when AI features are used.
System metadata (name, purpose, risk level), governance assessment scores, and obligation status. We do not send operational data, documents, or personally identifiable information beyond what you enter in the platform.
Per the Anthropic API Terms of Service, data sent via the API is not used for model training. Anthropic may retain API inputs for up to 30 days for safety monitoring, after which they are deleted.
Hexis processes minimal personal data. The platform handles governance metadata about AI systems — not the operational data those systems process.
Every database query is scoped to your organisation. Row Level Security (RLS) is enforced at the database level — not just in application code.
Email + password or Google OAuth. Sessions use short-lived JWTs refreshed automatically. Email verification is required for all accounts.
RLS policies on every table ensure users can only read and write data belonging to their own organisation. Cross-tenant data access is architecturally impossible.
Hexis is built by an ISO/IEC 42001 Lead Implementer and IAPP member with hands-on experience in AI governance implementation. The platform reflects real-world compliance needs, not theoretical checklists.
If you discover a security vulnerability or have questions about our data handling practices, contact us directly.