# Hex256

> Hex256 finds security gaps in a company's domain, code and cloud, opens fixes as pull requests, and drafts Indonesian personal data protection (UU 27/2022) documents. Built for Indonesian e-commerce and SaaS. Same group as Dampingin (legal services).

## Check a domain

- [Passive domain check API](https://hex256.com/api/cek?domain=example.co.id): `GET /api/cek?domain=<domain>` returns JSON with `grade` (A–E), `score` (0–100), `checks` and `findings`. Each finding has `ruleId`, `severity`, `track` (`teknis` = security, `hukum` = legal), `title`, `detail` and `fix`, written in Indonesian. Passive only: DNS, TLS, Certificate Transparency logs and the public homepage. Rate limited per IP; results are cached for one hour.
- [Partner API and MCP](https://hex256.com/developer): REST under `/api/v1` and a remote MCP server at `/api/mcp` (Streamable HTTP), authenticated with `Authorization: Bearer hx_live_...`. Tools: `status`, `cek_domain`, `daftar_temuan`, `petakan_kontrol` (ISO 27001 Annex A and UU PDP), `draf_insiden` (UU PDP Pasal 46 draft), `draf_ropa`. Priced in weighted hits per month; free plan 1,000 hits.
- [Human-readable report](https://hex256.com/cek?domain=example.co.id)

## Product

- [Full product description](https://hex256.com/llms-full.txt): what is checked, how prioritisation works, the UU PDP workflow, methodology, limits and FAQ in one plain-text file.

- [Pricing](https://hex256.com/harga): free check; Hex256 Cek Rp499.000/month (5 repos, 1 verified domain, 1 cloud account, automatic fix PRs, ROPA draft from the database schema); Readiness Sprint at a fixed price.
- [Scanning authorization](https://hex256.com/otorisasi): what runs without permission and what needs a verified domain or signed Rules of Engagement.

## Limits

- Hex256 is not an EDR or WAF and does not block attacks in real time.
- Hex256 does not replace the company's data protection officer (PPDP) and does not guarantee passing an audit.
- Legal findings are forwarded to Dampingin only with the customer's consent. Hex256 receives no referral fee.

## Contact

- Security reports: security@hex256.com
- Privacy: privasi@hex256.com