How HexTyx protects your data, secures our infrastructure, and operates with transparency.
All sensitive fields encrypted with AES-128-CBC (Fernet). Target URLs and exploit payloads never stored in plaintext. Key rotation supported.
ActiveIdentity data (Vault A) and scan data (Vault B) are stored in completely separate databases. A breach of one vault cannot expose the other.
ActiveEvery database table enforces Postgres RLS. Users can only access their own data — no query can return another user's records.
ActiveAll connections use TLS 1.3. API endpoints enforce HTTPS. Internal service communication is encrypted end-to-end.
ActiveIP addresses are never stored in plaintext. We store only a one-way SHA-256 hash. Google Analytics runs with IP anonymisation enabled.
ActiveYour scan results, targets, and findings are never used to train AI models — ours or our providers'. Your security data stays yours.
GuaranteedPro and Enterprise plans include a 99.5% monthly uptime SLA backed by our Railway deployment with automatic failover to Gemini fallback.
Pro+Data export (Art. 20), right to erasure (Art. 17), and data portability are all implemented. DPA available on request for Enterprise customers.
CompliantHealthcare organisations can execute a Business Associate Agreement (BAA) with FAVZ Group for HIPAA-covered workloads.
Enterprise+| Provider | Purpose | Location | Certification | Status |
|---|---|---|---|---|
| Anthropic | AI inference (scan engine) | USA | SOC 2 Type II | Operational |
| Supabase | Database (Vault A + B) | USA | SOC 2 Type II, ISO 27001 | Operational |
| Railway | Application hosting | USA | SOC 2 Type II | Operational |
| Stripe | Payment processing | USA | PCI DSS Level 1, SOC 2 | Operational |
| Vercel | Frontend hosting | Global CDN | SOC 2 Type II | Operational |
| Google (Analytics) | Usage analytics (anonymised) | USA / EU | ISO 27001, SOC 2, GDPR | Operational |
| Upstash / Redis | Semantic cache + rate limiting | USA | SOC 2 Type II | Operational |
| Google (Gemini) | Fallback AI inference only | USA | ISO 27001, SOC 2 | Fallback only |
| OpenAI | QA Reviewer 2 (Enterprise) | USA | SOC 2 Type II | Enterprise only |