Your business data stays in your environment.
Kitewell keeps workflows, knowledge, run logs, and credentials on your machine, and is designed so that you decide which AI models to use and what information leaves it.
Platforms
- macOS
- Windows
- LinuxComing
Is your data used to train AI?
You choose the AI, and that choice decides how your business data is handled. Here is how each main option handles it, under each provider's terms as of October 2026.
Paid cloud APIs
- The paid APIs of Anthropic, OpenAI, and Google Gemini state in their terms that what you send is not used to train AI by default
- Providers keep it for a limited time to watch for abuse (Anthropic and OpenAI, generally up to 30 days)
- Gemini's free tier uses what you send for training, so use a paid API for business data
Terms: Anthropic · OpenAI · Google Gemini
Your own cloud contract (Azure OpenAI)
- Your company's own Azure OpenAI works too: set its endpoint on the model
- What you send is processed in your own Azure resource, and Microsoft's terms say it is not used to train AI
Terms: Microsoft
In-house and local models
- With an in-house or local model server that speaks the OpenAI API (vLLM, Ollama, and others), business data never leaves your company
- Small local models usually cannot operate a screen, so steps that operate a screen need a model that can
Descarty
- Descarty never receives your business data, run results, or logs
- Descarty never uses synced workflows or knowledge to train AI, and never shares them with other customers
- When the assistant uses OpenRouter, its requests go only to providers that neither store nor train on them
Handling personal information
- AI receives only the screens and documents an AI step reads; repeating learned clicks and entries sends nothing
- You choose the model per step: give a step that handles personal information an in-house model, and keep the AI steps after it and its fallback models in-house too
- Passwords in web and desktop steps are referenced by name; the AI never receives the value
- Prompts sent to models are recorded in run history, so you can check what was sent
How data flows
Kitewell runs on your machine, and workflows run from it. Only the information shown below is sent out.
Your environment
Kitewell (engine: Dagu)
- Workflow definitions and change history
- Knowledge: what the team knows about its workflows
- Run logs, output files, and screenshots
- Encrypted credentials (secrets)
- Browser sign-ins
- Mailbox connections
- Conversations with the assistant
- Backups of Excel workbooks from before a write-back
The AI model provider you choose
- What is sent
- Visible page content during web steps, a screenshot of the whole screen during desktop steps, prompts in AI steps with the logs and output you pass, the rows of a batch sheet that AI reads, a failed run's steps and workflow for failure diagnosis, conversations with the assistant and the knowledge it reads; when a sheet is set up from an Excel workbook, its headings and up to 10 rows. A task for an AI agent such as Claude Code sends the prompt, and what the agent reads in its working folder, to that tool's provider
- When
- When a step, a batch sheet, or a failure diagnosis uses AI, or you use the assistant. Choose an in-house or local model and nothing is sent outside. Through OpenRouter, the assistant's requests go only to providers that neither store nor train on them.
Your business systems and websites
- What is sent
- The data your workflows enter and send
- When
- When a workflow runs as defined.
Alert channels (email, Slack, Teams, and others)
- What is sent
- Project, workflow, and step names, the run's result and times, and a link to the run
- When
- When you set up alerts. Step output, prompts, and inputs are never included.
Dagu Cloud (Descarty)
- What is sent
- Account, subscription, and device approval records, the machine's ID and name, and the Kitewell version; for a synced project, its definitions, knowledge, batch sheets, and secret names (never their values)
- When
- When you sign in to Dagu Cloud. Without a sign-in there is no such connection. Run results, logs, credentials, and workbook locations are never sent. Dagu Cloud stores its data in a Google Cloud region in the United States, and Descarty never uses it to train AI or shares it with other customers. Enterprise plans can keep sync inside your own environment.
Web search, through Dagu Cloud (Descarty)
- What is sent
- The words of each search the assistant makes, and the language Kitewell is shown in. Dagu Cloud (console.dagu.sh) passes them to Serper, which returns Google results, and keeps no query text, only the workspace, the device, and the credits the search used
- When
- When the assistant searches the web on a machine signed in to Dagu Cloud. Without a sign-in there is no search, and the assistant asks for addresses instead.
ChatGPT or Claude, through Kitewell's relay (Descarty)
- What is sent
- What the connected app reads through Kitewell's tools. The relay (mcp.kitewell.app, on Cloudflare) passes calls through without storing them, and keeps only the machine's name, Kitewell version, last-seen time, and last tool list. With MCP Events, each event ChatGPT subscribed to (project, workflow, run ID, status, times, failed step names, and a waiting step's question or task) goes to the address ChatGPT gives
- When
- Only after you connect the app, while remote access is on. Each app gets its own permission (read, run, or edit) and projects, which you can change or revoke at any time.
Kitewell's webhook relay (Descarty)
- What is sent
- Nothing from your machine. Requests that services send to a workflow's webhook URL wait at the relay (hooks.kitewell.app, on Cloudflare) until your machine takes them, for at most 7 days; only a hash of each URL's secret part is stored
- When
- Only after you turn on a webhook.
kitewell.app and GitHub
- What is sent
- An update check
- When
- When Kitewell checks for updates, and when you download the installer. Kitewell has no usage tracking.
Kitewell's documentation lists every destination too, updated with each release. What leaves your computer (kitewell.app)
Built to be used safely
Choice of AI model
- Choose major AI model APIs, or in-house and local model servers that speak the OpenAI API
- Small local models usually cannot operate a web page or a desktop app, so steps that operate a screen need a model that can
- Model API keys are stored encrypted as secrets and never written into workflows
- Prompts sent to models are recorded in run history
Credentials
- Secrets are stored encrypted with AES-256-GCM and cannot be read back once saved
- Passwords typed during web and desktop steps are referenced by name, so only the name reaches the AI model. A step with a password's value written into it stops before anything is sent to the model
- Web steps run in a browser kept for workflows, separate from the one you use every day, so the AI can use only the sign-ins made there
- Desktop steps send an image of the whole screen, so an app that shows a typed value in plain text shows it in that image too
- Secret values that appear in run logs are masked
- The assistant asks you to store a credential without seeing its value
What AI may do
- The assistant's changes to workflows and batch sheets are not saved until you review the diff and choose Apply
- The assistant's changes to knowledge are saved at once, with the changed lines marked and an immediate undo; after reading a web page or a run's output, it asks before saving
- The assistant cannot delete workflows or change other settings
- Values read from web pages and elsewhere are written to Excel as text, never as formulas
- Web steps can be restricted to the sites you allow
- AI agents such as Claude Code may only read their working folder by default
Access control
- Each API key has its own projects, permission (read, run, or edit), and expiry, and can be revoked on its own
- Projects shared with a team give each person a role
- Only people allowed to run workflows can approve or send back a step
- Outside connections are off by default and use HTTPS when turned on
- ChatGPT and Claude connect only through Kitewell's relay, after you connect them, and each app's permission can be changed or revoked at any time
Records and audit
- Every run records each step's logs, output, and duration
- Approvals, send-backs, and rejections are recorded with when they were made
- Workflow changes are kept as versions you can compare and restore
- Alert delivery history is available
- A robot ledger exports to Excel, its columns in the order of the robot management items in FISC's RPA guide
Operation and recovery
- Take backups by hand or on a schedule and restore them; stored secret values and their encryption key are left out of backups
- Engine updates are verified and backed up first, and can be rolled back
- Scheduled runs need the machine running Kitewell to be on
- A write-back to an Excel workbook can be undone; the workbook from before it, and its location, stay on the device and are never synced
The engine's source code is public
Dagu, the engine underneath Kitewell, is open source. Anyone can read the source code to see how it works.
About open source
Security documentation
Contact us for answers to your security questionnaire or a detailed explanation of the architecture. If you find a vulnerability, please write to this address.
Check it against your internal standards
From the PoC onward, we work with you on a setup that fits your security standards for AI models and data handling.