Security
Desk gives you a machine in the cloud, and runs agents that act in your systems. This page covers who can reach your machine, what an agent can reach and hold, and how you see what it did, including what we have not built yet.
1. Where Desk stands today
| Item | Status | What that means |
|---|---|---|
| Desk | Early access | Hosted on Amazon Web Services in the US (Oregon). |
| SOC 2 | Planned | Not certified yet. We will publish a date once an auditor is engaged, not before. |
| Third-party penetration test | Not yet | We test Desk against attacks ourselves. No outside firm has tested it yet. |
2. Your workstation
A workstation is your own long-lived machine. You have root on it, the way you do on a laptop.
- Its own virtual machine. Each workstation runs in its own virtual machine, never shared with another customer.
- Its own encrypted disk. Your files stay on an encrypted disk that is kept when the workstation stops and starts.
- Your sign-ins are yours. When you sign in to Claude Code, Codex or anything else on your workstation, that session stays on your disk, between you and that provider. Desk does not collect it.
- Only you get in. The browser terminal opens only for you, or someone you gave root, while signed in.
- Your apps are private. An app at
<name>.knb.soopens only for people signed in to Desk whom you gave access. You or an admin can take it down at once. - Outgoing traffic is recorded. A workstation can reach the internet, and Desk records each connection it makes.
3. Each agent run gets its own machine
- One machine per run. Every agent run starts in its own virtual machine, never shared between runs.
- No way in. A run’s machine accepts no inbound connections from the internet.
- One way out. A run reaches the network only through Desk’s gateway, which checks each call against what that run is allowed to do.
- Only our signed software runs. Machines start only from images Desk has signed.
4. Credentials stay out of an agent’s machine
- The gateway adds the credential, not the agent. Your keys and tokens are kept encrypted in a secret store that only the gateway can reach. The gateway adds them to each outgoing call, so they never enter the run’s machine.
- Kept apart per customer. One customer’s credentials are never used for another customer’s run.
- Short-lived access. Code-host tokens are scoped to the repositories you granted, and last for one run.
5. Approvals and the Record
- A person approves what matters. Actions that write to your systems, or reach people outside your team, wait in your Inbox for a person’s approval. What you approve is exactly what is sent.
- Merging is always human. Agents open pull requests. They never merge.
- The Record shows what happened. Every call a run makes is recorded outside its machine, where the agent cannot change it. You read what the run did, not what the agent says it did.
- Outside content is treated as data. Emails, web pages, webhooks and tool output never carry authority. A run that has read them is held to tighter rules.
- Runs are watched. Desk stops a run that shows signs of compromise and keeps the evidence for you.
6. Your data
- Location. Customer data is stored with Amazon Web Services in the US (Oregon).
- Encrypted. Data is encrypted at rest and in transit.
- Customers are kept apart. The database itself limits every query to one customer’s data.
- Backed up. The database is backed up automatically.
- Models. Agents use Anthropic’s Claude models on your own Anthropic account. Desk does not resell model usage. Anthropic’s commercial terms bar it from training on content sent through its API.
7. How we build and ship
- Every change is tested before it ships. Tests, security analysis, fuzzing and a check for dependencies with known vulnerabilities run on every change.
- Deployed by automation only. Production changes come from reviewed code through an automated pipeline, not by hand.
- A written threat model. Each safeguard on this page maps to a threat in it and to tests that check it.
8. What we do not have yet
- No SOC 2 or ISO 27001 report.
- No third-party penetration test.
- No uptime commitment or SLA, and no public status page.
If your security review needs any of these, tell us before you invest time. We answer security questionnaires, and we share more detail under NDA.
9. Subprocessors
These providers process customer data for hosted Desk. We will post changes here at least 14 days before a new subprocessor starts processing customer data. To be told, email [email protected].
| Provider | Purpose | Data it receives | Location |
|---|---|---|---|
| Amazon Web Services | Hosting | All customer data Desk holds | US (Oregon) |
| Cloudflare | Network edge, DNS and protection against attacks for Desk’s web and API traffic | Requests to Desk, IP addresses | Global edge |
| WorkOS | Sign-in | Name, work email, sign-in identifiers | US |
| Resend | Email an agent sends, after approval | Recipients and message content | US |
Services you connect
Some services are reached only when you connect them, using your own account or key. They act for you, not for us, and receive only what your runs send them: Anthropic (the models your agents run on, on your own account), GitHub (through the Desk GitHub App you install) and the web search provider whose key you add. What you sign in to from your own workstation is between you and that provider.
Our website, kinobi.so, has its own providers, listed on the Trust page.
10. Reporting a vulnerability
Email [email protected] with “Security” in the subject, or see security.txt. Please include the affected address or endpoint, steps to reproduce and the impact. We acknowledge within 3 business days. We will not take legal action against good-faith research that respects user privacy, avoids degrading the service and gives us reasonable time to fix before disclosure.
Incident notification
If customer data we hold is breached, we notify affected customers without undue delay and within 72 hours of becoming aware, and we notify regulators where required.