Security and access
Hexagon publishes security information about its infrastructure, access practices, monitoring and subprocessors. Start with Security at Hexagon for the current statements and contact details.
Security review should match the product, connected systems and data your team plans to use.
What the security page covers
The page describes hosting and managed storage, encryption in transit and at rest, access to production systems, server-side handling of provider credentials, monitoring and vulnerability checks.
It also provides responsible-disclosure information and a subprocessor description. Review the live page when assessing a deployment because providers and audit status can change.
Ask specific questions
For an enterprise review, identify the information that matters to your organization:
- Which systems and data will the workflow use?
- Who will authorize access and own the process?
- Which people should receive its outputs?
- What retention and deletion requirements apply?
- Which contractual or audit information does your security team need?
Bring these requirements to Hexagon before assuming a particular deployment or control is available.
Check current audit status
Use the status stated on the security page and any report Hexagon supplies for your review. An audit in progress is different from an issued report or completed certification. Contact Hexagon for audit reports and deployment-specific requirements.
Report a concern
Follow the responsible-disclosure contact on the security page for a suspected vulnerability. Include the affected component and enough detail to understand the issue, without collecting or sharing unrelated customer information.
For data-use questions, also review Privacy and your data.