Security & Privacy

Understand how Kerno handles your code and data.

Kerno is designed to keep your code local. This page explains what data stays on your machine, what gets sent to LLM providers, and what Kerno collects to power its services.

Your code stays local

The Kerno agent runs on your machine. Your repository, dependency graph, test environment, scenarios, and baselines all live on your filesystem and inside your local Docker containers. Kerno never copies your code to its servers for storage.

What leaves your machine

Kerno uses large language models to generate scenarios, reason about your code, and orchestrate environment setup. The agent sends relevant excerpts of your code to LLM providers through Kerno's proxy.

Kerno currently uses Anthropic, OpenAI, and Google as LLM providers, all configured with zero-data-retention tiers. Provider terms guarantee that your code is not stored, logged, or used for training or fine-tuning.

What Kerno collects

The Kerno agent reports two kinds of metadata to Kerno's services:

• Discovered endpoints (HTTP method, path, file location)

• Validation results (which scenarios ran, diff status, timing)

No code content is sent. This metadata powers the Kerno panel and dashboard views for your team.

Encryption and compliance

All data Kerno manages is encrypted at rest with AES-256 and in transit with TLS 1.2+. SOC 2 Type II compliance is in progress.

For questions, contact us at [e-mail].