The fee is the smallest difference. The structural test is everything.
Does every identity issued from your HexaEight Marketplace VMs carry your own root domain? If yes, the audit passes. If even one identity is hosted under someone else's domain, Certified status is not granted.
Every identity carries partnerbank.ai as the root. The customer subdomain in the middle is the audit trail. The partner has staked their brand on every install.
Three different customer-owned root domains on the same partner VM. Legitimate business (the partner is hosting customer-owned identities), but they aren't staking their own brand on anything. Verified is fine. Certified is not granted.
Where the VM runs doesn't matter. Whose root domain is on the identities does.
Partner runs HexaEight Marketplace VMs in their own Azure (or AWS, GCP) subscription. They pay for the compute. They host many customers per VM. The partner's product moat stays inside their infrastructure.
Customer's Azure subscription pays for the compute, but the partner operates the VM and assigns partner-domain identities. DNS for the partner's identities points to the VM in the customer's subscription.
The audit doesn't read your source code, your customer contracts, or your business operations. It reconciles two lists.
If a HexaEight-branded identity is involved in a security incident, key compromise, customer complaint about misuse of HexaEight branding, fraud claim, or any business-conduct issue, the partner discloses to HexaEight within 72 hours. Non-disclosure suspends the Verified or Certified badge pending review.
Same product, different operating shapes. The shape determines the tier.
A regional banking AI startup builds a Compliance Suite. They install HexaEight Marketplace VMs in each customer bank's Azure subscription, but they own and operate those VMs. Identities are issued as agent01.newbank.partnerbank.ai, agent01.acmebank.partnerbank.ai, agent01.thirdcorp.partnerbank.ai. Partner's root domain on every identity, customer subdomain in the middle. Partner moat (Compliance Suite logic) stays inside their VMs.
A SaaS company runs an "agentic AI workflow platform." They host HexaEight Marketplace VMs in their own subscription. Every tenant signup automatically provisions an identity like tenant42.acmeagents.com inside their VM. Customers buy the platform; identity is a primitive they never have to think about.
A systems integrator wraps HexaEight identity into an enterprise customer's existing agent stack. They install a Marketplace VM (in either subscription), provision the identity under partner-domain (e.g., agent01.enterprisecust.si-partner.com), and own the operational lifecycle. Customer pays one invoice for software-with-services.
A regional cloud provider sells agentic identity to SMBs in their market with local currency, local invoicing, and a local support hotline. They run HexaEight Marketplace VMs and host identities for many small customers. If those identities carry the regional reseller's root domain, they qualify for Certified. If they carry each customer's own domain (raw license passthrough), they remain Verified.
A hosting provider deploys a Marketplace VM and rents identity slots to end customers. Each customer brings their own domain (bridge.newbank.com, bridge.acmecorp.com). The partner provides compute + the HexaEight platform but doesn't stake their own brand on any identity. Legitimate business; Verified Partner. Not eligible for Certified because the structural audit signal (partner domain on every identity) isn't there.
Tell us how you operate today: how you deploy HexaEight Marketplace VMs, how you name your identities, and the volume you expect to hit. If you're already running Verified, applying for Certified is straightforward.
Apply via [email protected]