Skip to main content

Buyer guide

Hex Security & AI Data Governance Checklist

SSO, warehouse authentication, sensitive connections, AI training and retention settings, BYOK, and where Hex stores query results.

Reading time
2 min read
Sources
11 cited
In this piece
Hex+65 Strong positive

Settle sign-in, warehouse access, and AI data settings before you connect the warehouse to Hex. Live query results sit in an isolated kernel, while stored cell outputs persist indefinitely unless a select Enterprise plan sets a retention period. Model providers receive schemas and project code under zero data retention by default.

When you need this

  • Security review asks how Hex authenticates users and the warehouse.
  • Legal asks which AI providers see company data, and whether anything trains on it.
  • The data team is about to let Hex's agent answer in Slack or in other AI assistants.

Evaluation criteria

  1. Identity

    How will people sign in?

    Look forSSO through OIDC on Enterprise, with providers such as Google, Okta, Entra, or Duo. Hex does not support SAML. Hex lists SCIM directory sync from Okta, Active Directory, and Google for Enterprise.

  2. Warehouse access

    Does each user query with their own warehouse permissions?

    Look forOAuth connections on Enterprise for Snowflake, BigQuery, and Databricks, which pass through each user's permissions. Without them, only Admins create workspace connections, Admins, Managers, and Editors can create project-level connections, and Enterprise Admins can choose to disable project-level connections.

  3. AI data use

    What do Hex's AI features send, and is any of it used for training?

    Look forHex sends schemas, project code, and outputs as model context. Providers work under zero data retention by default, and models that require provider retention run only if an Admin enables them. Set the AI training opt-out in Settings > AI & agents.

  4. Model routing

    Must inference run through your own provider account?

    Look forBring-your-own-key on Enterprise for Anthropic and OpenAI directly, or Claude through AWS Bedrock or Google's agent platform, with Require your own API keys switched on. A request that cannot use your key fails.

  5. Slack, MCP, API, and CLI access

    Which data can Slack, MCP, the API, and the CLI reach?

    Look forSensitive connections marked before you turn these routes on. MCP, API, and CLI queries skip sensitive connections unless an Admin allows them, and the Slack agent can reply privately when it uses one.

  6. Storage and compliance

    Where do results live, and what has been audited?

    Look forHex processes and stores data on AWS. Cell outputs are stored indefinitely unless a select Enterprise plan sets a 7 to 90 day retention policy, and cached warehouse results not read for 30 days are deleted. SOC 2 Type II and HIPAA audits run annually. Hex offers EU, HIPAA, and single-tenant deployments.

Questions to ask vendors

  1. Which plan includes the AI training opt-out terms our contract needs?
  2. Which models in the picker require provider retention, and do we allow them?
  3. Which connections should be marked sensitive before Slack and MCP go live?
  4. Is the EU stack or a single-tenant deployment required for our data?

Red flags

  • Planning SAML SSO, which Hex does not support.
  • Shared service-account credentials on a connection that business users query through Slack.
  • Assuming query results are never stored, when cell outputs persist indefinitely unless an Enterprise retention policy is set.
  • Enabling retention-requiring models without a decision from security.

Products in this piece

Sources

Official documentation
11
  1. Hex docs: SSOOfficial documentationlearn.hex.tech
  2. Hex: EnterpriseOfficial documentationhex.tech
  3. Hex: Data securityOfficial documentationhex.tech
  4. Hex Trust CenterOfficial documentationtrust.hex.tech
  5. Hex docs: Data connections introductionOfficial documentationlearn.hex.tech
  6. Hex docs: AI in HexOfficial documentationlearn.hex.tech
  7. Hex docs: AI data privacyOfficial documentationlearn.hex.tech
  8. Hex docs: Data retentionOfficial documentationlearn.hex.tech
  9. Hex docs: Sensitive data connections for external integrationsOfficial documentationlearn.hex.tech
  10. Hex docs: Hex Agent in SlackOfficial documentationlearn.hex.tech
  11. Hex docs: Hex MCP serverOfficial documentationlearn.hex.tech

Keep reading

  1. Buyer guideHex AI Rollout PlaybookHow to curate context, open Threads to business users, and gate each data domain on evals before Hex's agents reach the whole company.
  2. Buyer guideHex Seats, Credits & Spend ChecklistWhich roles need paid seats, how monthly credit grants and the workspace pool work, and where to cap agent spend and compute.
  3. Buyer guideMoving Dashboards From Looker or Tableau to HexHow to audit, rebuild, and retire Looker or Tableau dashboards in Hex, what the migration agent does, and what the data team still checks.
Read the research