Frequently asked questions

AIZA-HexTyx is one AI security platform with three components: HexTyx Scanner, which red-teams your AI system with 23 scan phases and 33 attack modules; Aegis Runtime Shield, which checks live traffic at five checkpoints; and AXIOM + Memory Graph, which explain findings and accumulate attack intelligence across scans. It is built for teams that ship LLM apps, RAG pipelines and AI agents.

Run the free playground scan, which needs no signup, or create a free account to scan your own AI system with HexTyx Scanner. Results arrive in minutes with MITRE ATLAS-mapped findings, and the free plan needs no credit card. Before each scan you confirm that you are authorised to test the target.

Yes. The free plan costs $0 and includes 5 scans per month, a full findings report, the core 10 of 23 scan phases, JSON and executive report formats, and MITRE ATLAS technique mapping. Extra scan packs start at $79 and PDF report credits start at $9.

Pro is $199 per month, with founder pricing of $169 per month locked for life while founder slots last. It includes unlimited scans, all 23 scan phases, all 7 report formats, full API access, CI/CD integration and priority support. Extra seats start at $99 per seat per month. Enterprise is custom-priced with a custom contract, SLA and DPA. Annual plans include 2 months free.

You can cancel any time from your account settings or by emailing support@hextyx.com, with no cancellation fees. Cancellation takes effect at the end of the billing period. New annual subscribers who have run no more than 5 scans can request a full refund within 30 days. Completed scans, plan downgrades and unused scan credits are not refunded.

Yes. You may only test systems you own or have explicit written permission to test. By submitting a target for scanning you attest that you have that authorisation, and misuse that breaches the Acceptable Use Policy leads to account termination without a refund.

Your scan results, targets and findings are never used to train AI models. Account data and scan data are held in separate databases, so a breach of one cannot expose the other. Sensitive fields such as target URLs and exploit payloads are encrypted at rest, and IP addresses are stored only as one-way hashes. Scan reports are kept for 12 months by default and can be deleted on request.

The sub-processor list names every third party that handles customer data, and registered account holders get at least 10 days' notice before a new one is added. Enterprise plans include a GDPR Data Processing Agreement, and healthcare organisations can execute a Business Associate Agreement. Our hosting and database providers hold SOC 2 Type II reports.

Pro plans carry a 99.5% monthly uptime target and Enterprise plans 99.9%, with service credits if the target is missed. Status history is published at status.hextyx.com. Pro includes priority support, and Enterprise adds dedicated onboarding. You can reach the team at support@hextyx.com.

Pro and Enterprise plans include full API access and CI/CD pipeline integration, so scans can run on every model, prompt or retrieval change. Reports come in 7 formats: SARIF, STIX 2.1, PDF, MITRE ATT&CK, JUnit, JSON and an executive summary. The free plan includes JSON and executive formats.