HexaHQ

Product

Overview Company knowledge Multi-AI workflows Connect any API How it works Security & governance For teams

Use cases

All use cases

Pricing

Plans & pricing

Compare

All comparisons

Resources

Answers Blog Help center Guides & comparisons FAQ About
Sign in Start free
Security & control

Your company's knowledge. Your connected systems. Under your control.

HexaHQ protects the knowledge your team teaches AI and governs how AI works across your tools. Keep company knowledge private and permissioned, protect the credentials behind your connections, and see what your AI does.

Start free Review our security practices
One central document connected by light to four smaller panels, each receiving only its part. Company knowledge

Your company knowledge stays yours.

HexaHQ gives your organization one shared, curated source of context for AI, instead of a pile of files scattered across tools. Knowledge can be private or shared with the right people, and company-owned knowledge stays with the company when employees leave.

  • Owned by your organization, not by one employee
  • Shared by role: some people read, some suggest changes, a few edit
  • Every saved version kept, with who wrote each line
  • Deletion goes to a trash first, then is permanent
A request passes through a gate with three lanes on its way to a connected system, above a timeline that records each step. Connected systems

Your connections stay protected.

Connect AI to the tools your team already uses without pasting credentials into conversations. HexaHQ keeps connection credentials away from the AI, applies an action policy to each capability, and records actions for review.

  • Credentials encrypted twice, with a key kept outside the database
  • Allow, ask, or deny, set for each capability
  • A record of every action, with who it acted for
  • By default, each person connects their own account and approves its access
How your knowledge is protected

Built to hold what your company knows.

Knowledge is shared with your team by default, and you decide how far each piece goes. Keep a document private, limit a folder to the people named on it, or have changes reviewed before they become company context.

sales/pricing_exceptions Company version

When a discount needs a second approver

Belongs to
Your organization
Sales group
Editor
Everyone else
Viewer
History
Version 7, each change attributed

  • Organization-owned

    Company knowledge belongs to the organization, not to a particular employee. When someone leaves, what was shared with the company stays, and an admin decides what happens to their private drafts.

  • Permissioned sharing

    Share a folder or a single document with people, groups, or the whole company, as a Viewer, Suggester, Editor, or Admin. Only Admins can give anyone new access, and a folder can be restricted to the people named on it.

  • Encrypted and separated

    Everything is encrypted in transit with TLS 1.2 or newer and at rest with AES-256. Each company's data is kept separate. It reaches another company only when one of your Admins shares it. HexaHQ's servers can read your knowledge, since that is how they hand the right part to your AI.

  • Deletion and retention

    A deleted document goes to a trash where it can be restored for 30 days. Deleting it again, or waiting out the 30 days, removes it and every saved version for good. Database backups are kept for seven days on a rolling basis, and the activity log keeps its record that an action ran.

How connected systems are protected

AI can do real work without handling your passwords.

Credentials are collected and stored outside the AI conversation. HexaHQ uses them to run the specific operations you're allowed to run, under an action policy, with a record of each one.

  1. Your AI Asks to run a capability, such as "update this deal"
  2. HexaHQ capability and policy Checks who is asking and applies the capability's policy: allow, ask, or deny
  3. Protected credentials Used on HexaHQ's server to make the call, never sent to the AI
  4. Connected service Your CRM, inbox, or tracker, with only the access that connection was granted

Every executed action is recorded.

Each capability carries a policy

Allow
Runs without prompting. Typical for reads.
Ask
Asks your AI app to get the person's confirmation first. Actions that write, send, or delete start here.
Deny
Blocks the action.

Your organization sets the policy for each capability. The Ask confirmation is shown by your AI app, so if someone tells that app to always allow a tool, it stops asking. The record of what ran is kept either way.

How credentials are kept

You enter a password or API key in your browser, on a HexaHQ page, or sign in with the service's own consent screen. It never passes through the chat.

Stored credentials are encrypted twice. The database encrypts everything it holds. HexaHQ then encrypts each credential again with AES-256-GCM, using a key protected by AWS Key Management Service and never stored in the database. A copy of the database on its own reveals no credentials.

When you share a capability with a coworker, you share what it does, not your login. By default each person connects with their own account, and the record shows who the AI acted for.

For your security team

Security claims backed by real controls.

  • Verified, September 2026

    Google OAuth verification

    Google reviewed and approved how HexaHQ uses Gmail, Calendar, and Drive data, including Google's restricted Gmail and Drive access.

  • Accepted, September 2026

    Google CASA, Level 1

    TAC Security, an independent lab, assessed HexaHQ against Google's Cloud Application Security Assessment, including a scan of the live app. It repeats every year.

    Request the results
  • HexaHQ audit under way

    SOC 2 Type II

    HexaHQ is operated by Salesbot Labs, Inc., which holds a SOC 2 Type II report and is independently assessed every year. HexaHQ's own Type II audit is under way, and a status letter is available.

    Request the letter
  • Verified, October 2026

    Microsoft verified publisher

    Microsoft confirmed HexaHQ's identity, so signing in with Microsoft shows HexaHQ as a verified publisher.

Our Data Processing Agreement supports GDPR and UK GDPR, including Standard Contractual Clauses, and covers our role as a service provider under the CCPA/CPRA. Send your security questionnaire to the address above.

Technical details

Hosting
Amazon Web Services in the United States (Oregon), in HexaHQ's own dedicated AWS account. The database sits in a private network, can't be reached from the internet, and keeps a live standby copy in a second AWS data center.
Monitoring
Administrative actions in our cloud account are logged to a tamper-evident trail, threat detection watches the account, and a daily check confirms our security settings are still in force.
Sign-in
Sign in with Google or Microsoft so your own sign-in rules and second factor apply. Passwords must be at least 12 characters, and repeated failed attempts lock the account.
Secure development
Code, dependencies, containers, and secrets are scanned before a change can ship. Infrastructure is defined in version control, and app releases are versioned.
Incident response
We keep a documented incident response plan and notify affected customers as our Data Processing Agreement and the law require.
Your AI's own controls
Admin settings in your AI app, such as Claude Team's, still decide which features are on at all. HexaHQ governs the specific actions and keeps the record.
Questions reviewers ask

Straight answers

Can HexaHQ employees see our knowledge?

In narrow cases, yes. Your knowledge is encrypted at rest but not end-to-end, because HexaHQ's servers have to read it to give your AI the right part. Authorized HexaHQ personnel can access production systems on a least-privilege basis, to run and support the service. When support needs to see the app as one of your people, that session is limited to 30 minutes and recorded in our security audit log.

Does HexaHQ use our knowledge to train AI?

No. HexaHQ does not sell customer data, and does not use it to train generalized AI or machine-learning models. HexaHQ does not run its own AI model over your knowledge. The AI app your team uses is a separate provider with its own data terms, so check those settings too.

Does company knowledge go to ChatGPT or Claude?

Only what a task needs, and only what the person asking is allowed to read. When someone asks their AI to do something, HexaHQ hands that AI the relevant knowledge. From there, the AI provider's own data policies apply.

Can the AI see our passwords or API keys?

No. You enter them on a HexaHQ page or on the service's own sign-in screen. HexaHQ uses them on its server to make each call, and the AI only sees the result.

What happens when someone leaves?

An admin removes them, and their access to your organization stops on their next request, in the app and through any AI app they connected. Knowledge shared with the company stays. The admin chooses whether their edits to company documents go to review or are deleted, and whether their private space is kept in a folder only admins can read or deleted. Credentials they connected are revoked with the provider and deleted.

Can we delete our data?

Yes. Single documents follow the trash and backup timeline in "Deletion and retention" above. An admin can also delete the whole organization, which removes its documents, workflows, capabilities, connections, and stored credentials. The security audit log is kept.

Report a security issue

If you think you've found a vulnerability, email security@hexahq.ai. We'll confirm we received it and keep you updated while we look into it. Please give us a chance to fix it before you share it publicly.

Give your team shared context without giving up control.

Start with the knowledge your team wants AI to use. Add connected tools as you're ready.

Start free