Skip to main content
This section is written for the people who sign off on new tools: security, infosec, IT, and data privacy teams. There are three ways to reach your Kowalah data:
  • The web platform (app.kowalah.com) — your team, in a browser. This is how most people use Kowalah.
  • The Claude Connector — querying your Kowalah data from inside Claude.
  • The Kowalah Agent — the same, from Slack, Teams, or Google Chat.
This section covers Kowalah at two levels: the platform and the company behind it (which includes the web platform above), and a deep dive on the two AI access points — the Connector and the Agent — which share a single data boundary worth examining on its own.

Platform and company security

What the platform is built on, where your data lives, what happens to it across an engagement, who can access it, and what keeps the AI safe.

AI access points

A deep dive on the Claude Connector and the Kowalah Agent — exactly what they can and cannot do, and how to verify it.

​
One data boundary, two access points

Both customer-facing AI surfaces connect to the same server — the Kowalah Client MCP at mcp.kowalah.com — and reach data through the same set of tools, with the same limits. Their data boundary is identical. Where they differ is in what they do with the model, not what data they can reach:
  • The Connector answers questions and explores your data inside Claude.
  • The Agent actively coaches your team — it uses skills (a coach, a use-case advisor, and a workflow designer) to be a sparring partner and help design AI workflows in the flow of work.
That difference is delivered through skills, which are knowledge and instructions for the model — not extra data access. So your security team only has to evaluate one data model, and the Agent is never more privileged than a person using the Connector. For how this bears on the exfiltration question, see data flow and exfiltration.

​
Headline guarantees

Least privilege by design

Half the tools are read-only. The writes can raise an opportunity and maintain your own AI Operating Model, nothing else, and each one is gated by where the user sits in your own org chart. No tool can delete anything — that capability does not exist in the code.

Strict tenant isolation

Every database query is filtered to your organization through a single, tested function. A user can only ever see data for organizations they are an accepted member of.

No training on your data

Anthropic does not use data sent through its commercial APIs to train its models. Your conversations and data are not used to improve any model.

Authenticated as the individual

Access is always tied to a real, authenticated user and their role. The Agent resolves identity per message, so each person only ever sees their own organization’s data.

​
How data flows

When someone uses the Connector or the Agent, their request is authenticated, scoped to their organization, and answered from the Kowalah database. Data is fetched on demand for that single request — nothing is bulk-copied or mirrored. The two surfaces take different routes to the same place — and importantly, a different Claude does the work in each:

Both surfaces converge on the same org-scoped boundary — but a different Claude does the work. Click to enlarge.

  • Connector: it’s your Claude. The conversation happens inside your own Claude workspace, on your own subscription and your own agreement with Anthropic. Kowalah never sees the conversation — the only thing that reaches Kowalah is the tool calls arriving at the MCP server.
  • Agent: it’s Kowalah’s Claude. Messages to the Agent are processed by Kowalah’s Claude, via Anthropic’s API under Kowalah’s commercial terms — covered by the same no-training commitment and our subprocessor disclosures.
  • Either way, the same boundary. Both routes land on the same Kowalah Client MCP, which scopes every query to the user’s organization before it touches the database — and the database returns only that organization’s data, with internal fields stripped and non-client records filtered out.

​
What’s in this section

Platform and company security

Platform architecture and hosting

What the platform is built on, where your data is stored, and how the customer app is separated from internal systems.

Your data across an engagement

What Kowalah does with your data at each stage of delivery, from discovery workshops through build and deployment.

Access and identity controls

Authentication, role-based permissions, and the controls that stop users doing more than they should.

AI safety and guardrails

What stops the AI taking harmful or unintended actions, or being manipulated into doing so.
AI access points

Data flow and exfiltration

What can and can’t move between your organization and Kowalah, why these tools exist, and how to verify it yourself.

Data and access control

Authentication, tenant isolation, role-based permissions, least privilege, and how data is handled and retained.

Chat platform security

Slack and Teams OAuth scopes explained, how the Agent is triggered (mention or DM), account linking, revocation, and admin controls.

Subprocessors and compliance

The full list of subprocessors, where data is hosted, AI model handling, and the Data Processing Agreement.

Infosec FAQ

Direct answers to the questions security teams ask most — ready to forward.
Have a question this section doesn’t cover, or a vendor security questionnaire you need completed? Talk to your Kowalah team and we’ll respond directly.