> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kowalah.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data flow and exfiltration

> What data can and cannot move between your organization and Kowalah, why these tools exist, and how your security team can verify it independently.

The first question a security reviewer asks about any AI tool is: **can this move our private data out of our control?** This page answers that directly, explains what these tools are actually for, and shows you how to verify the answer yourself rather than take our word for it.

## Purpose: these are inbound-help tools

The Connector and the Agent exist to bring *your own Kowalah programme data to you* and help you act on it. They are not data-collection tools.

<CardGroup cols={2}>
  <Card title="Claude Connector" icon="plug">
    Lets a user **ask about and explore their Kowalah data** from inside Claude, and raise a new idea. It answers questions; it does not gather information about your organization.
  </Card>

  <Card title="Kowalah Agent" icon="bot">
    **Coaches your team on applying AI** to their real work, in Slack or Teams. It uses skills (a coach, a use-case advisor, and a workflow designer) to be a sparring partner — its value is the help it gives, not data it takes.
  </Card>
</CardGroup>

The Agent does *more than* the Connector — it actively coaches and helps design workflows. But it does so using **skills**, which are knowledge and behaviour, **not** additional data access. Both surfaces reach data only through the same three tools described below.

## The direction of data flow

Almost everything flows **from Kowalah to your user** — the tools read your programme data and present it in the conversation. There is exactly one path in the other direction.

```mermaid theme={null}
flowchart LR
  K[(Your Kowalah data)] -->|read, scoped to your org| U[Your user<br/>in Claude / Slack / Teams]
  U -->|"only when the user explicitly<br/>raises an opportunity"| O[New Opportunity<br/>OPP-XXXX in your workspace]
```

## The only way data goes back to Kowalah

The connector exposes **three tools, and exactly one of them writes anything**:

| Tool                 | Direction               | What it does                                                                   |
| -------------------- | ----------------------- | ------------------------------------------------------------------------------ |
| Get an update        | Read                    | Returns your programme status. Nothing is written.                             |
| Find an accelerator  | Read                    | Searches the library. Nothing is written.                                      |
| Raise an opportunity | **Write (create only)** | Creates one new opportunity record, **only when the user explicitly asks to**. |

So the single channel through which any content reaches Kowalah is a **user-initiated opportunity** — a short description of an idea the user *wants* to send to Kowalah for triage. There is:

* **No** tool that uploads, exports, syncs, or copies your data to Kowalah
* **No** tool that reads your files, email, drives, calendars, or source code
* **No** background process that harvests conversations or scans your workspace
* **No** ability to edit or delete existing data

These aren't policies that could be changed by configuration — the capabilities simply do not exist in the connector's code.

## What each surface can reach

<Tabs>
  <Tab title="Claude Connector">
    The Connector can reach **only the three Kowalah tools**. It has **no access whatsoever** to anything else on the user's machine or in your environment — no files, no email, no other applications. There is no private data for it to exfiltrate, because it cannot see any private data outside Kowalah in the first place.
  </Tab>

  <Tab title="Kowalah Agent">
    The Agent can reach the **same three Kowalah tools**, plus **the content of the conversation it has been brought into** — the channel thread it's `@mentioned` in, or a direct message a user starts with it — which it needs in order to respond. It does not read channels it wasn't invited into, does not crawl history, and has no tool to write conversation content anywhere into Kowalah. The only thing it can send to Kowalah is the same user-initiated opportunity.
  </Tab>
</Tabs>

## What the Agent remembers

To be a useful coach across a conversation, the Agent keeps short-lived context for the thread and a per-user/per-organization memory. This is held in **Anthropic's managed infrastructure** (a named [subprocessor](/security/subprocessors)), scoped to the individual user and their organization, and is **never** pooled across customers or used to train models. It is processing to help the user in the moment, not collection into Kowalah's systems. Conversation content is not written into Kowalah's customer database unless the user raises an opportunity.

## How to validate this yourself

You don't have to take our word for any of the above. Here's how your security team can verify it independently.

<Steps>
  <Step title="Enumerate the tool surface">
    The connector advertises its full tool list over the standard MCP protocol (`tools/list`), and it's documented at [available tools](/integrations/mcp/available-tools). Confirm for yourself that there are three tools, that two are read-only, and that none can upload, export, or read anything outside Kowalah.
  </Step>

  <Step title="Audit the OAuth scopes in your own admin console">
    For the Agent, your Slack or Teams admin console shows exactly which permissions the app requested and was granted. Confirm there are **no** file, drive, email, or external-data scopes. See [chat platform security](/security/chat-platforms) for the full list and the reason for each.
  </Step>

  <Step title="Monitor egress with your existing tooling">
    The Connector and Agent only communicate with `mcp.kowalah.com` and Anthropic. Your CASB, DLP, or network egress monitoring will confirm there are no other destinations and no bulk data transfers.
  </Step>

  <Step title="Inspect everything that was created">
    Because the only write is an opportunity, you can see **exactly** what has ever been sent to Kowalah: every opportunity appears in your own workspace with an `OPP-XXXX` number, the submitter, and the full content. Nothing reaches Kowalah without leaving this audit trail.
  </Step>

  <Step title="Confirm it only acts when addressed">
    Your Slack or Teams audit log records when the app was invoked. Confirm the Agent only acts when directly addressed — an `@mention` or a direct message — and never passively.
  </Step>

  <Step title="Pilot in a contained space">
    Add the Agent to a single channel, or give the Connector to a small group, and observe its behaviour before a wider rollout.
  </Step>
</Steps>

<Tip>
  Want to see the tool list and request/response shapes directly? Ask your Kowalah team for a walkthrough, or point your own MCP client at `mcp.kowalah.com` and inspect the `tools/list` response.
</Tip>