Your business data stays in your environment.
Kitewell keeps workflows, run logs, and credentials on your machine, and is designed so that you decide which AI models to use and what information leaves it.
- macOSBeta
- WindowsComing
- LinuxComing
How data flows
Kitewell runs on your machine, and workflows run from it. Only the information shown below is sent out.
Your environment
Kitewell (engine: Dagu)
- Workflow definitions and change history
- Run logs, output files, and screenshots
- Encrypted credentials (secrets)
- Browser sign-ins
- Conversations with the assistant
The AI model provider you choose
- What is sent
- Visible page content during web steps, prompts in AI steps, and conversations with the assistant
- When
- When a step uses AI or you use the assistant. Choose an in-house or local model and nothing is sent outside.
Your business systems and websites
- What is sent
- The data your workflows enter and send
- When
- When a workflow runs as defined.
Alert channels (email, Slack, Teams, and others)
- What is sent
- Project, workflow, and step names, the run's result and times, and a link to the run
- When
- When you set up alerts. Step output, prompts, and inputs are never included.
Dagu Cloud (Descarty)
- What is sent
- Account, subscription, and device approval records; for team sharing, workflow definitions and secret names (never their values)
- When
- When you use a paid plan or share with a team. The free plan needs no account and makes no such connection.
Built to be used safely
Choice of AI model
- Choose major AI model APIs, or in-house and local model servers that speak the OpenAI API
- Model API keys are stored encrypted as secrets and never written into workflows
- Prompts sent to models are recorded in run history
Credentials
- Secrets are stored encrypted with AES-256-GCM and cannot be read back once saved
- Passwords typed during web steps are referenced by name, so only the name reaches the AI model
- Secret values that appear in run logs are masked
- The assistant asks you to store a credential without seeing its value
What AI may do
- Changes from the assistant are not saved until you review the diff and choose Apply
- The assistant cannot delete workflows or change other settings
- Web steps can be restricted to the sites you allow
- AI agents such as Claude Code may only read their working folder by default
Access control
- Each API key has its own projects, permission (read, run, or edit), and expiry, and can be revoked on its own
- Projects shared with a team give each person a role
- Only people allowed to run workflows can approve or send back a step
- Outside connections are off by default and use HTTPS when turned on
Records and audit
- Every run records each step's logs, output, and duration
- Approvals, send-backs, and rejections are recorded with who made them and when
- Workflow changes are kept as versions you can compare and restore
- Alert delivery history is available
Operation and recovery
- Take backups by hand or on a schedule and restore them; stored secret values and their encryption key are left out of backups
- Engine updates are verified and backed up first, and can be rolled back
- Scheduled runs need the machine running Kitewell to be on
The engine's source code is public
Dagu, the engine underneath Kitewell, is open source. Anyone can read the source code to see how it works.
About open source
Security documentation
Contact us for answers to your security questionnaire or a detailed explanation of the architecture. If you find a vulnerability, please write to this address.
Check it against your internal standards
From the PoC onward, we work with you on a setup that fits your security standards for AI models and data handling.