Security & privacy, by design.

Tenant isolation

Every tenant-owned row carries the organization it belongs to, and every query filters by the organization on the acting identity — never by an id from the request body. An address that names an organization you are not a member of returns the same "not found" as one that does not exist, so membership is never even confirmed to an outsider. One organization's work is never visible to another.

Least-privilege access

People act through roles — viewer, member, admin, owner — checked by a single permission matrix shared by the web app, the API and the MCP endpoint. Machine access uses API tokens scoped to exactly what they need; a session-scoped token is limited to one session's Work. Passwords are hashed with argon2 and tokens are stored only as hashes — the plaintext of a token is shown once, at creation, and never again.

Metadata-only by default

The daemon that runs sessions on your machines defaults to metadata only: it reports what happened — states, events, outcomes — without uploading transcripts or source. Raising that is a deliberate act, and it can only ever be raised as far as the organization's and the project's privacy ceiling allows. Sessions are also confined to an explicit list of allowed workspaces; a session that tries to start outside them is refused.

The privacy ceiling and retention

Each organization sets a privacy ceiling, and each project sits at or below it — no project can be configured to keep more than its organization permits. Retention is configurable, so metadata and records age out on a schedule you choose rather than accumulating forever. Data minimization, purpose limitation and configurable retention are design requirements here, not options.

No per-person ranking

Kernel measures work, not people. It reports work outcomes and runtime performance; it does not produce developer rankings, individual productivity scores or keystroke-like monitoring. This is a deliberate stance for the employment contexts Kernel is used in, and it shapes what the analytics can and cannot compute.

A hardened web surface

The application serves a strict Content-Security-Policy with no inline scripts, sets X-Frame-Options, a referrer policy and HSTS in production, checks the origin of every unsafe request, and protects cookie-authenticated forms with a session-bound CSRF token. Markdown an agent writes is rendered through a strict sanitiser — the HTML it chose is never executed.

Your data stays portable

An organization's data can be exported and taken out — Kernel is a system of record, not a place data gets trapped. Being self-hosted and local-first, the record lives in your own deployment.

Read the architecture docs →