Skip to main content
The first question a security reviewer asks about any AI tool is: can this move our private data out of our control? This page answers that directly, explains what these tools are actually for, and shows you how to verify the answer yourself rather than take our word for it.

​
Purpose: these are inbound-help tools

The Connector and the Agent exist to bring your own Kowalah programme data to you and help you act on it. They are not data-collection tools.

Claude Connector

Lets a user ask about and explore their Kowalah data from inside Claude, and raise a new idea. It answers questions; it does not gather information about your organization.

Kowalah Agent

Coaches your team on applying AI to their real work, in Slack or Teams. It uses skills (a coach, a use-case advisor, and a workflow designer) to be a sparring partner — its value is the help it gives, not data it takes.
The Agent does more than the Connector — it actively coaches and helps design workflows. But it does so using skills, which are knowledge and behaviour, not additional data access. Both surfaces reach data only through the same tools described below.

​
The direction of data flow

Almost everything flows from Kowalah to your user — the tools read your programme data and present it in the conversation. Two paths run the other way, and both are explicit user actions that land inside your own workspace.

​
The two ways data goes back to Kowalah

The connector exposes 12 tools: six read, six write. Every write is user-initiated and lands in your own workspace. So content reaches Kowalah through exactly two channels, both deliberate:
  1. A user-initiated opportunity — a short description of an idea the user wants to send to Kowalah for triage.
  2. A user’s own operating-model edits — the same process and org-unit records your team already maintains in the web platform, reached through a different door. This is your description of how your business runs, authored by you, in your own tenant.
There is:
  • No tool that uploads, exports, syncs, or copies your data to Kowalah
  • No tool that reads your files, email, drives, calendars, or source code
  • No background process that harvests conversations or scans your workspace
  • No ability to delete anything, of any kind
  • No ability to edit a project, deliverable, Expert Request, contract, or existing opportunity — those stay read-only
These aren’t policies that could be changed by configuration — the capabilities simply do not exist in the connector’s code.
Operating-model writes carry a second gate on top of tenant scoping: a user may edit only what they own or what sits below them in your own org-unit tree, with admins and core team able to edit across their own organization. Everything else routes to a proposal instead. See the altitude gate.

​
What each surface can reach

The Connector can reach only the Kowalah tools listed above. It has no access whatsoever to anything else on the user’s machine or in your environment — no files, no email, no other applications. There is no private data for it to exfiltrate, because it cannot see any private data outside Kowalah in the first place.

​
What the Agent remembers

To be a useful coach across a conversation, the Agent keeps short-lived context for the thread and a per-user/per-organization memory. This is held in Anthropic’s managed infrastructure (a named subprocessor), scoped to the individual user and their organization, and is never pooled across customers or used to train models. It is processing to help the user in the moment, not collection into Kowalah’s systems. Conversation content is not written into Kowalah’s customer database unless the user raises an opportunity.

​
How to validate this yourself

You don’t have to take our word for any of the above. Here’s how your security team can verify it independently.
1

Enumerate the tool surface

The connector advertises its full tool list over the standard MCP protocol (tools/list), and it’s documented at available tools. Confirm for yourself that the list matches the table above, that no tool deletes anything, and that none can upload, export, or read anything outside Kowalah. Each tool also declares a machine-readable readOnlyHint and destructiveHint you can check without reading a single description.
2

Audit the OAuth scopes in your own admin console

For the Agent, your Slack or Teams admin console shows exactly which permissions the app requested and was granted. Confirm there are no file, drive, email, or external-data scopes. See chat platform security for the full list and the reason for each.
3

Monitor egress with your existing tooling

The Connector and Agent only communicate with mcp.kowalah.com and Anthropic. Your CASB, DLP, or network egress monitoring will confirm there are no other destinations and no bulk data transfers.
4

Inspect everything that was written

Every opportunity — raised directly or filed as a process-change proposal — appears in your own workspace with an OPP-XXXX number, the submitter, and the full content. Operating-model changes appear on the map in the platform, where your team can review them and correct anything wrong. Both land in your tenant, in views your own admins already have.
5

Confirm it only acts when addressed

Your Slack or Teams audit log records when the app was invoked. Confirm the Agent only acts when directly addressed — an @mention or a direct message — and never passively.
6

Pilot in a contained space

Add the Agent to a single channel, or give the Connector to a small group, and observe its behaviour before a wider rollout.
Want to see the tool list and request/response shapes directly? Ask your Kowalah team for a walkthrough, or point your own MCP client at mcp.kowalah.com and inspect the tools/list response.