Secure Identities
for the AI Era

There is no limit on the number of users who can authenticate via Front Door — this applies to both Personal and Business licences. The difference is in Workspace access: Personal restricts Workspace login to the licence purchaser only, while Business allows any policy-allowed HexaEight user to log in.

A Business licence covers a single agent identity on your own machine. The Azure Marketplace VM lets you run multiple agents with different identities on the same machine — useful when you need separate authentication boundaries or want to isolate workloads. Both remove the single-owner restriction, but Azure adds the ability to scale identities without extra infrastructure. Azure is also Microsoft MACC-eligible, so organisations with Azure commitments can apply existing credits toward the licence.

Certificates require Certificate Authorities, renewal cycles, revocation infrastructure and synchronous key exchange. None of that exists here. You can encrypt to any identity, including agents that do not exist yet. Identity is name-bound, not certificate-bound.

Key derivation is SHAKE-256 based. The platform provides per-peer pairing material for any identity. You encrypt with your password plus that material; the recipient decrypts with their own password and their own material. Different inputs, same channel secret. The platform brokers the lookup but is never in the message path.

Yes — and the list is not the point. An engine is a process rather than a library binding, so your framework never imports anything of ours. If it can take a message and return a reply, it already works.

Our own SOC 2 is on the roadmap and not yet issued; we will not represent it as complete until it is. At the infrastructure layer the platform runs on Microsoft Azure, giving inherited SOC 2 Type II, ISO 27001 / 27017 / 27018, HIPAA BAA and FedRAMP in Azure Gov regions.

Bedrock and Foundry are AI gateways. HexaEight is the identity layer that sits in front of them. We do not compete with hyperscalers. We provide a cryptographic identity primitive that they (or you) can bundle and resell on top of their own AI services.

The license is cryptographically tied to the machine it was activated on. Activation creates a hexaeight.mac file and an env-file containing the hostname, login token, password, and license code. Copying these files to a different machine will not work; the license validates against the original machine's environment. The Personal license is also bound to your machine's exact CPU-core count.

Yes. Activate the Azure Marketplace VM, move the identities you want to migrate, and let the earlier license expire naturally. The tiers can also run side-by-side indefinitely.

Yes. Personal and Business licenses can be paid in ₹ — look for the "In India? Pay in ₹" link on each card. International customers check out in USD on the HexaEight Store.

No, and you should be wary of anyone who says otherwise. Your router still holds a key for your model provider, and your own code may still call a billing API with one. Those are commercial credentials for services you already pay for, and they belong in exactly one place. What changes is that a key is no longer how two parties recognise each other, and no longer copied into every agent that might need it.

No. The license buys a cryptographic identity, not inference. HexaEight does not supply models and does not license you to use anyone else's. You bring your own provider key. That is deliberate: it keeps you free to choose your model, change it, or run one locally, without your identity layer having an opinion about it.

No, and most people should not. The agent handles identity and orchestration and is light. The LLM traffic goes through a router, which can run on a different machine entirely — or you can skip it and call an external provider directly. Your agent machine does not need to be large just because there is AI in the product.

It stops working. There is no grace subscription to fall back on. If you need uninterrupted operation, buy yearly — that is exactly what it is for.

Nothing. They stay exactly as they are. An expired license stops the agent running — it does not delete anything. Come back in a month, or three, renew, and everything is as you left it. Renewal runs a full month from the day you renew, not from the day it lapsed, so a gap costs you nothing beyond the time you were not using it. If you have a quiet season, you are welcome to stop and pick it up later.

It was emailed to you at purchase, so check there first. If you need support, send us the SHA-512 hash of the code rather than the code itself — that proves you hold it without the code travelling by email or landing in a support ticket.

Measure the two things that actually tell you: the time from request to response, and the load on the machine at peak. While response times stay flat under your busiest conditions, you have headroom. When they begin to stretch, that is the signal — add cores, or add a second license with the same identity name behind a load balancer. The second option is usually the better one, because it buys resilience as well as capacity.

Because cores are what actually run out. Users, agents, and messages are unlimited and unmetered — none of them are what limits you. Concurrent work is, and on an agent that means skills executing. AI work is also unusually heavy: an ordinary API call finishes in milliseconds, while an agent turn takes seconds because tokens are generated rather than looked up, so each one holds capacity far longer. Cores are the honest measure of how much of that you can do at once.

No — never. The HexaEight Authenticator is free for everyone, permanently. Anyone can install it, hold an identity, and authenticate with your agent without paying us anything. There is no paid user tier and no per-user charge anywhere in the model. You license the machine your agent runs on; your users cost nothing.

Pairing material requests, and nothing else. It never receives ciphertext, never relays a message and never holds plaintext — the encrypt and decrypt paths make no call to it. The reference client is published so you can trace that yourself rather than take our word for it.