Healthtech tenant (AWS)

openssl x509 -in root.pem -noout -subject -fingerprint

AWS / EKS · healthcare denial review

# trust domain

agents.hexr.cloud

# root

Hexr Root CA 2026

E8:E6:77:6D:91:26:99:B5:CC:3A:73:C3:47:F3:AD:B1:7C:5F:73:62…

Globex People

openssl x509 -in root.pem -noout -subject -fingerprint

Azure / AKS · candidate screening (HR tech)

# trust domain

globex-azure.agents.hexr.cloud

# root

Hexr Root CA Globex 2026

74:C8:C4:CA:7B:AB:80:7E:36:D1:6C:3E:6A:1A:0A:E3:9D:75:CB:04…

Cross-tenant verification — runs hourly, unattended

deployment/demos/verify-tenant-isolation.sh · CronJob hexr-isolation-check

Credential from	Checked against	Result
healthtech	healthtech	verified
healthtech	globex	refused
globex	globex	verified
globex	healthtech	refused

error 19 at 2 depth lookup:
  self-signed certificate in certificate chain
error healthtech-1.pem: verification failed

A credential from one tenant is not denied by the other. It is unverifiable: the chain ends at a certificate the other side has never seen. There is no policy to misconfigure. A property nobody re-checks is a memory; this one is re-checked every hour and fails loudly.

Try it — paste any certificate

POST /api/verify-svid · stateless, nothing stored, nothing reaches a cluster

Paste any X.509 certificate. One of ours, one of yours, or something unrelated — the answer is more interesting when it is not ours.

Nothing is stored. Nothing reaches a cluster.