> For the complete documentation index, see [llms.txt](https://kerno.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kerno.gitbook.io/docs/references/security-and-privacy.md).

# Security & Privacy

Kerno is designed to keep your code local. This page explains what data stays on your machine, what gets sent to LLM providers, and what Kerno collects to power its services.

### Your code stays local

The Kerno agent runs on your machine. Your repository, dependency graph, test environment, scenarios, and baselines all live on your filesystem and inside your local Docker containers. Kerno never copies your code to its servers for storage.

### What leaves your machine

Kerno uses large language models to generate scenarios and reason about your code. The agent sends relevant excerpts of your code to LLM providers through Kerno's proxy.

Kerno currently uses Anthropic and OpenAI as LLM providers, all configured with zero-data-retention tiers. Provider terms guarantee that your code is not stored, logged, or used for training or fine-tuning.

### What Kerno collects

The Kerno agent reports metadata about your test runs to Kerno's services:

* Discovered endpoints (HTTP method, path, file location)
* Validation results (outcome, and counts of scenarios run, added, updated, removed, and differences detected)
* Repository and branch name

No source code is sent.

### Run reports

When you review a test run in the IDE extension, the run report is uploaded so it can be viewed in the [Kerno portal](/docs/portal/overview.md) by you and your team.

A run report includes the HTTP exchange each scenario produced against your application: request body and headers, response body and headers, and status code. This is what the portal's report view renders, and it is attributed to the account that ran the test.

{% hint style="info" %}
These are the request and response payloads your application produced during a test run, not your source code. If your endpoints return sensitive data, that data is part of the report. Consider this when testing against environments holding production or production-like data.
{% endhint %}

### Encryption and compliance

All data Kerno manages is encrypted at rest with AES-256 and in transit with TLS 1.2+. SOC 2 Type II compliance is in progress.

For questions, contact us at <security@kerno.io>.