Security follows the data and the tools that can act on it
Kition makes credentials, network access, Agent actions, and automation controls explicit so teams can review and constrain them.
Data storage
Documents, `.kitable` tables, workspace assets, workflows, and Agent history live in the local workspace. Provider credentials, account sessions, logs, caches, and device preferences live outside it. Kition Cloud, external providers, browser pages, sync connections, and optional analytics can send selected data over the network when used.
API keys and credentials
In Kition 0.1.41, AI provider keys are plaintext files in Kition application data. They are outside the workspace but are not encrypted and do not use the OS keychain. Protect the device and disk, use limited provider keys, and revoke exposed credentials remotely.
Auditable agent tool calls
The Agent timeline can show model turns, tool calls, arguments, results, errors, plans, artifacts, and changed paths. Shell approval and feature-specific previews exist, but 0.1.41 does not ship a universal per-tool permission or Hooks interception UI.
Network egress control
Updates, Kition Account and Cloud, external AI providers, web tools, the embedded browser, connected services, and optional analytics can make outbound requests. Use provider limits, Kition proxy settings, OS firewall controls, and least-privilege accounts to constrain them.
Vulnerability disclosure
Found a vulnerability? Email [email protected]. We commit to responding within 5 business days and follow standard CVD practices.
Ready when you are.
Kition is a desktop AI workspace for connected documents, structured tables, editable designs, whiteboards, visual workflows, and reviewable AI agents.