SECURITY & DATA HANDLING
The security story is short: we never have your data.
Kymira is not a platform you upload data to. It is expertise, shipped as plain text files, that runs inside the agent your company already uses, on your machine. There is no Kymira server in your data path, so there is nothing of yours for us to lose.
How it actually runs
- ✓The skills are plain text. Markdown files your agent reads before it works. No binaries, no runtime, no background processes.
- ✓Your exports stay where they are. Everything runs on your machine or in your own accounts. Kymira has no server that ever sees a customer file, and the product contains no telemetry.
- ✓The only network calls carry a key, never data. The installer verifies your license and the updater fetches new skill versions. Both send a license key and nothing else.
- ✓The intranet deploys to your Cloudflare account. Your credentials, your Zero Trust wall, your audit log. We never host it and never hold a key to it.
What your agent sees is unchanged
Your data is processed by the coding agent you already run, under your existing agreement with its provider. Kymira adds zero new data surface. If Claude Code or Cursor is approved at your company, installing Kymira changes nothing about where your data goes: it changes how carefully the agent treats it. Anthropic's commercial terms do not train on business API data by default; confirm the terms of your own plan, because that agreement, not ours, is the one that governs your data.
Auditable to the last line
There is no black box to trust. Before installing anything, your IT team can open every file and read every line of what the agent will follow, the way they would review a policy document. The free tier is public and MIT-licensed on GitHub as a specimen of exactly what ships.
The skills teach data discipline
Certification is also a containment practice. The skills instruct the agent to:
- ✓Keep raw files in a local landing zone and work from file paths, never pasting raw data where a path will do.
- ✓Flag sensitive columns before the first chart: emails, names, compensation, customer terms, account numbers, named to you before anything displays them.
- ✓Aggregate before sharing. Pages for a wider audience show groups, not rows; row-level detail requires an explicit instruction.
- ✓Treat screenshots and decks as exports, carrying the same review as the pages they came from.
On certifications
Kymira holds no SOC 2, for a simple reason: those certifications attest to how a vendor handles customer data, and we never handle it. The audit that matters here is the one your own team can run in an afternoon: read the files, watch the network tab, confirm nothing leaves.