Your business data stays in your environment.

Kitewell keeps workflows, knowledge, run logs, and credentials on your machine, and is designed so that you decide which AI models to use and what information leaves it.

Platforms

Windows, Windows ServerSupported
macOSSupported
LinuxComing

Is your data used to train AI?

You choose the AI, and that choice decides how your business data is handled. Here is how each main option handles it, under each provider's terms as of October 2026.

Paid cloud APIs

The paid APIs of Anthropic, OpenAI, and Google Gemini state in their terms that what you send is not used to train AI by default
Providers keep it for a limited time to watch for abuse (Anthropic and OpenAI, generally up to 30 days)
Gemini's free tier uses what you send for training, so use a paid API for business data

Terms: Anthropic · OpenAI · Google Gemini

Your own cloud contract (Azure OpenAI, Amazon Bedrock, Google Vertex AI)

Your company's own Azure OpenAI, Amazon Bedrock, and Google Vertex AI models work too
What you send is processed in your own cloud account, and each provider's terms say it is not used to train AI

Terms: Microsoft · AWS · Google Cloud

In-house and local models

With an in-house or local model server that speaks the OpenAI API (vLLM, Ollama, and others), business data never leaves your company
Small local models usually cannot operate a screen, so steps that operate a screen need a model that can

Kitewell's included model

The included model, which needs no API key, reads screens with OpenAI GPT-6.1 Terra and does everything else with DeepSeek V4.1 Flash (as of November 2026)
Requests go through Descarty's server to OpenRouter, and only hosts that neither store nor train on what they receive (zero data retention) answer them
DeepSeek V4.1 Flash runs only on hosts headquartered in the United States or the EU, never DeepSeek itself or a host based in China. GPT-6.1 Terra runs only on Microsoft Azure in the EU
Descarty keeps no request text. You can also leave the included model unused and use only your own cloud contract or in-house models

Descarty

Descarty never receives run results or logs. Business data passes through Descarty's server only in requests to the included model and the assistant's web searches, and their text is not kept
Descarty never uses synced workflows or knowledge to train AI, and never shares them with other customers
Kitewell Cloud and Kitehand run in environments Descarty operates in a Google Cloud region in the United States. This page covers Kitewell on your own computers and in your company's environment

Handling personal information

AI receives only the screens and documents an AI step reads; repeating learned clicks and entries sends nothing
You choose the model per step: give a step that handles personal information an in-house model, and keep the AI steps after it and its fallback models in-house too
Passwords in web and desktop steps are referenced by name; the AI never receives the value
Prompts sent to models are recorded in run history, so you can check what was sent

How data flows

Kitewell runs on your machine, and workflows run from it. Only the information shown below is sent out.

In a closed-network setup, nothing connects out. Each outside destination below is either kept in-house or not used. See closed-network deployment

Your environment

Kitewell (engine: Dagu)

Workflow definitions and change history
Knowledge: what the team knows about its workflows
Run logs, output files, and screenshots
Encrypted credentials (secrets)
Browser sign-ins
Mailbox connections
Conversations with the assistant
Backups of Excel workbooks from before a write-back

The AI model provider you choose
What is sent
Visible page content during web steps, a screenshot of the whole screen during desktop steps, prompts in AI steps with the logs and output you pass, the rows of a batch sheet that AI reads, a failed run's steps and workflow for failure diagnosis, conversations with the assistant and the knowledge it reads; when a sheet is set up from an Excel workbook, its headings and up to 10 rows. A task for an AI agent such as Claude Code sends the prompt, and what the agent reads in its working folder, to that tool's provider
When
When a step, a batch sheet, or a failure diagnosis uses AI, or you use the assistant. Choose an in-house or local model and nothing is sent outside. The assistant's requests through OpenRouter and the included model's requests go only to hosts that neither store nor train on them. The included model's requests pass through Descarty's server.
Your business systems and websites
What is sent
The data your workflows enter and send
When
When a workflow runs as defined.
Alert channels (email, Slack, Teams, and others)
What is sent
Project, workflow, and step names, the run's result and times, and a link to the run
When
When you set up alerts. Step output, prompts, and inputs are never included.
Kitewell's account and sync service (run by Descarty)
What is sent
Account, subscription, and device approval records, the machine's ID and name, and the Kitewell version; for a synced project, its definitions, knowledge, batch sheets, and secret names (never their values)
When
When you sign in to a Kitewell account. Without a sign-in there is no such connection. Run results, logs, credentials, and workbook locations are never sent. The service stores its data in a Google Cloud region in the United States, and Descarty never uses it to train AI or shares it with other customers. Enterprise plans can keep sync inside your own environment.
Web search, through Kitewell's account and sync service (Descarty)
What is sent
The words of each search the assistant makes, and the language Kitewell is shown in. The service (console.dagu.sh) passes them to Serper, which returns Google results, and keeps no query text, only the workspace, the device, and the credits the search used
When
When the assistant searches the web on a machine signed in to a Kitewell account. Without a sign-in there is no search, and the assistant asks for addresses instead.
ChatGPT or Claude, through Kitewell's relay (Descarty)
What is sent
What the connected app reads through Kitewell's tools. The relay (mcp.kitewell.app, on Cloudflare) passes calls through without storing them, and keeps only the machine's name, Kitewell version, last-seen time, and last tool list. With MCP Events, each event ChatGPT subscribed to (project, workflow, run ID, status, times, failed step names, and a waiting step's question or task) goes to the address ChatGPT gives
When
Only after you connect the app, while remote access is on. Each app gets its own permission (read, run, or edit) and projects, which you can change or revoke at any time.
Kitewell's webhook relay (Descarty)
What is sent
Nothing from your machine. Requests that services send to a workflow's webhook URL wait at the relay (hooks.kitewell.app, on Cloudflare) until your machine takes them, for at most 7 days; only a hash of each URL's secret part is stored
When
Only after you turn on a webhook.
Shared computers and the browser workspace (enterprise, Descarty)
What is sent
When people work in the browser, the screens, the assistant conversation, and run logs and results travel from the shared computer through the relay to the browser, and are not stored. The workspace keeps what sync keeps, the definitions and knowledge, plus run status, approval inputs, and send-back notes. A password typed in the browser passes only encrypted with that computer's key
When
Only when an enterprise plan uses shared computers. On a VM Descarty hosts, Descarty's operators administer that VM.
kitewell.com and GitHub
What is sent
An update check
When
When Kitewell checks for updates, and when you download the installer. Kitewell has no usage tracking.

Kitewell's documentation lists every destination too, updated with each release. What leaves your computer (kitewell.com)

How in-house systems are connected inside your network, and how the work runs, is on the on-premises page. See on-premises integration

Built to be used safely

Choice of AI model

Choose major AI model APIs, or in-house and local model servers that speak the OpenAI API
Small local models usually cannot operate a web page or a desktop app, so steps that operate a screen need a model that can
Model API keys are stored encrypted as secrets and never written into workflows
Prompts sent to models are recorded in run history

Credentials

Secrets are stored encrypted with AES-256-GCM and cannot be read back once saved
Passwords typed during web and desktop steps are referenced by name, so only the name reaches the AI model. A step with a password's value written into it stops before anything is sent to the model
Web steps run in a browser kept for workflows, separate from the one you use every day, so the AI can use only the sign-ins made there
Desktop steps send an image of the whole screen, so an app that shows a typed value in plain text shows it in that image too
Secret values that appear in run logs are masked
The assistant asks you to store a credential without seeing its value
On an enterprise shared computer, a password typed in the browser is encrypted with that computer's key before it is sent, so Descarty and the relay receive only ciphertext

What AI may do

The assistant's changes to workflows and batch sheets are not saved until you review the diff and choose Apply
The assistant's changes to knowledge are saved at once, with the changed lines marked and an immediate undo; after reading a web page or a run's output, it asks before saving
The assistant cannot delete workflows or change other settings
Values read from web pages and elsewhere are written to Excel as text, never as formulas
Web steps can be restricted to the sites you allow
AI agents such as Claude Code may only read their working folder by default

Access control

Each API key has its own projects, permission (read, run, or edit), and expiry, and can be revoked on its own
Projects shared with a team give each person a role
Only people allowed to run workflows can approve or send back a step
Outside connections are off by default and use HTTPS when turned on
ChatGPT and Claude connect only through Kitewell's relay, after you connect them, and each app's permission can be changed or revoked at any time
An enterprise shared computer checks who each request comes from and whether they hold the role it needs, and records it

Records and audit

Every run records each step's logs, output, and duration
Approvals, send-backs, and rejections are recorded with when they were made
Workflow changes are kept as versions you can compare and restore
Alert delivery history is available
A robot ledger exports to Excel, its columns in the order of the robot management items in FISC's RPA guide

Operation and recovery

Take backups by hand or on a schedule and restore them; stored secret values and their encryption key are left out of backups
Engine updates are verified and backed up first, and can be rolled back
Scheduled runs need the machine running Kitewell to be on; on an enterprise plan, a shared computer can be a VM that is always on
Before a write-back, a copy of the Excel workbook stays on the device, and neither it nor its location is ever synced

The engine's source code is public

Dagu, the engine underneath Kitewell, is open source. Anyone can read the source code to see how it works.

About Dagu

Security documentation

Contact us for answers to your security questionnaire or a detailed explanation of the architecture. If you find a vulnerability, please write to this address.

[email protected]

Check it against your internal standards

From the trial onward, we work with you on a setup that fits your security standards for AI models and data handling.

Try free for 14 days Book a 30-minute demo