Security

How Krosswalk works

Krosswalk has three parts: the Slack app your team talks to, our API, and an agent that runs on a machine dedicated to your organization. Your repositories are cloned onto that machine and nowhere else. When someone asks a question, the agent reads the code locally and sends only the context it needs to Anthropic's Claude models to compose an answer.

  Your Slack workspace
          │
          ▼
  Krosswalk API  ──────────────  PostgreSQL
          │                      (row-level isolation per customer)
          ▼
  Your dedicated agent machine
    • your cloned repositories
    • your connected data sources
          │
          ▼
  Anthropic (Claude)

If you would rather host the agent yourself, you can. In that setup your code never leaves your infrastructure, and the agent connects out to our API over an authenticated channel.

Where your data goes

Three things move between systems, and nothing else:

• Your repositories are cloned from GitHub onto your dedicated machine using an installation token scoped to the repositories you select. They stay on that machine's encrypted disk.
• Question context — the question, the surrounding Slack thread, and the specific files or query results the assistant chose to read — is sent to Anthropic to generate an answer.
• Answers and conversation history are stored in our database so threads keep their context, and are posted back to your Slack workspace.

We do not store copies of your repositories in our database. We do not send your code to any model provider other than Anthropic. Data sources you connect, such as a product analytics tool or a warehouse, are queried directly from your machine using credentials you supply.

AI and your data

The question we get asked first, answered plainly: Anthropic does not train its models on data submitted through its API, and Krosswalk uses the API exclusively. This is the default under Anthropic's Commercial Terms of Service. It is not something we had to negotiate, and there is no setting to get wrong.

• Inputs and outputs are retained briefly by Anthropic for trust and safety screening, then deleted. See Anthropic's data retention policy.
• Zero-retention processing is available from Anthropic on request if your policy requires it. Tell us and we will arrange it.
• Krosswalk does not train models of its own and does not use your code or conversations to improve any model.

What the assistant can and cannot do

The assistant's abilities are fixed in code, not decided by the model. It is given an explicit list of permitted actions for each kind of work, and any call outside that list is refused and recorded.

• No shell access. The assistant cannot run arbitrary commands, in any mode. This is enforced by the permitted-action list and covered by automated tests.
• No writes to your other tools. Connected data sources are available for reading only. Where a tool accepts free-form queries, the query is inspected and anything other than a single read is rejected.
• Nothing merges itself. Every code change lands as a pull request. Your existing review and CI rules apply unchanged.
• Secrets are stripped from output. Messages are scanned for credential-shaped strings before they reach Slack or our logs.
• Permissions are yours to set. Administrators define groups controlling which repositories and data sources each team can reach, whether they can request code changes, and what needs approval.

Isolation between customers

Every customer gets a dedicated virtual machine with a dedicated storage volume. Your code is never on the same disk or in the same process as another customer's. There is no shared agent and no shared workspace.

In our database, isolation is enforced by the database itself. Every table carrying customer data has row-level security policies keyed to the organization on the signed-in session, so a query cannot return another customer's rows even if application code asks for them. This is verified by an automated test suite that runs on every change.

Encryption

• In transit: TLS everywhere — browsers, Slack, GitHub, Anthropic, and the connection between your agent and our API.
• At rest: credentials and tokens are encrypted with AES-256-GCM using a key derived per organization, so one customer's key cannot decrypt another's data. Databases and agent storage volumes are encrypted at rest by the underlying platform.
• Access keys: stored as one-way hashes and compared in constant time. Keys can be rotated from your dashboard at any time.

Access controls

• Sign-in to the dashboard is through Google or GitHub. Krosswalk never handles a password.
• Roles — member, builder, and administrator — determine who can request code changes, manage integrations, and change permissions.
• Rate limits apply per user and per organization, enforced in the database so they hold across every server.
• Activity is recorded. Sign-ins, integrations connected and disconnected, permission changes, proposed and confirmed code changes, and blocked actions are all written to an audit log you can read in your dashboard.

Who at Krosswalk can see your data

Access to customer data is limited to a named list of Krosswalk staff, held in our database rather than in application code, so access can be granted or revoked immediately and without a software release. Today that list is a single person; it will grow slowly and deliberately.

Staff access to any customer's data is recorded in the same audit log as everything else, including which organization was opened and when. We access customer data only to operate the service or to resolve a problem you have reported.

Retention and deletion

Two rules govern deletion, and nothing else deletes your data:

• Message history is kept for 90 days by default and then deleted automatically. If your policy calls for a shorter or longer window, we can set it for your organization.
• Cancellation destroys everything. Within 24 hours of cancelling, your agent machine and its storage volume — including every cloned repository — are destroyed, and all of your records, conversations, integration credentials and message history are deleted from our database. The 24-hour window exists so an accidental cancellation can be reversed; after it passes, the data is gone.

We do not delete anything because an account has been quiet. An idle agent machine is powered down to save cost, which touches no data and is reversed the moment someone asks a question. You can also request deletion at any time by writing to us.

Subprocessors

These are the vendors that may process customer data in the course of running Krosswalk.

Tools you choose to connect — a product analytics platform, a warehouse, a CRM — are not Krosswalk subprocessors. They are your systems, queried with credentials you provide, and you can disconnect them at any time.

Incident response

We maintain a written incident response plan covering detection, containment, customer notification, and follow-up review.

If an incident affects your data, we will notify you within 72 hours of confirming it, with what we know, what we have done, and what you should do. A written follow-up with root cause and corrective actions follows within two weeks.

Compliance

Krosswalk is an early-stage company and we would rather be straightforward about where we are than imply more than is true.

• SOC 2 Type II is planned. The controls described on this page are built and running; the formal audit is not yet underway. If a SOC 2 report is a requirement for your team, talk to us about timing.
• Data processing agreements are available on request.
• Self-hosting is supported today if your policy does not allow source code on a vendor's infrastructure.

Contact

Reach our security team at security@krosswalk.io. We acknowledge every report within one business day.

If you believe you have found a vulnerability, please tell us before disclosing it publicly. We will keep you updated while we investigate, and we will not pursue legal action against researchers acting in good faith.