Security & Privacy
Understand how Kerno handles your code and data.
Kerno is designed to keep your code local. This page explains what data stays on your machine, what gets sent to LLM providers, and what Kerno collects to power its services.
Your code stays local
The Kerno agent runs on your machine. Your repository, dependency graph, test environment, scenarios, and baselines all live on your filesystem and inside your local Docker containers. Kerno never copies your code to its servers for storage.
What leaves your machine
Kerno uses large language models to generate scenarios and reason about your code. The agent sends relevant excerpts of your code to LLM providers through Kerno's proxy.
Kerno currently uses Anthropic and OpenAI as LLM providers, all configured with zero-data-retention tiers. Provider terms guarantee that your code is not stored, logged, or used for training or fine-tuning.
What Kerno collects
The Kerno agent reports metadata about your test runs to Kerno's services:
Discovered entry points (HTTP method, path, file location)
Validation results (outcome, and counts of scenarios run, added, updated, removed, and differences detected)
Repository and branch name
No source code is sent.
Run reports
Kerno uploads the report of every test run your agent starts so it can be viewed in the Kerno portal by you and your team.
A run report includes the HTTP exchange each scenario produced against your application: request body and headers, response body and headers, and status code. This is what the portal's report view renders, and it is attributed to the account that ran the test.
Encryption and compliance
All data Kerno manages is encrypted at rest with AES-256 and in transit with TLS 1.2+. SOC 2 Type II compliance is in progress.
For questions, contact us at security@kerno.io.
Last updated