Security your whole team can trust

isolation

Your own Private Cloud

Every Kumo workspace runs in its own Private Cloud with dedicated storage. Memory, files, repositories, and traces stay scoped to you. One company's agent can never see, reach, or be reached by another's.

secrets

Credentials stay out of the AI's reach

API keys and tokens are sealed with AES-256-GCM, injected only at the moment they're needed, and never placed in the model's prompt. That's the architecture, not just a policy.

your data

We never train on your data

We don't sell your content and never use it to train models. We run on major providers, including OpenAI and Anthropic, whose API terms prohibit training on what we send them.

access

Conservative access by default

Connected tools are read-only-safe with a per-integration allowlist. Private connections are used only on turns from the member who connected them, and you can revoke any source at any time.

egress watcher

Outbound request monitoring (rolling out)

We're rolling out a runtime watcher that monitors proxied outbound web requests and asks an egress judge to catch likely credential or company-data leaks. It runs on our own internal workspace first and is being extended to customer workspaces, so it may not yet be enabled for a given workspace. When enabled it runs in shadow (surfacing review questions in the agent workspace) before any blocking, and in enforce mode those requests are blocked. It depends on traffic honoring the runtime proxy, so we describe it as cooperative monitoring rather than an airtight firewall.

ingress

Only signed traffic becomes work

Slack and Stripe events are signature-verified with timestamp freshness windows and timing-safe checks. Duplicate deliveries are de-duplicated, so a retry never triggers a second agent run.

infrastructure

Hardened control plane

The web app is served over TLS, the backend runs on Fly.io behind bearer-token calls, Private Clouds run on Modal, and deploys are automated with narrowly scoped credentials.