Privacy & Data Routing

Engineering privacy without compromise. Your source code stays on your machine, routed strictly through non-training commercial endpoints.

On-Device Local AST Processing

The most critical security boundary in Kernax is our client-first architecture. Unlike legacy cloud-based code editors, your source code repositories are never cloned or mirrored to remote servers.

Code parsing, AST symbol extraction, dependency graph resolution, and .gitignore filtering execute 100% locally on your device using native Tree-sitter binaries:

• No Full-Repo Uploads: Only the exact, surgical AST nodes necessary to solve your active prompt traverse our API boundary.
• Client-Side Path Exclusion: .env files, SSH keys, credentials, and custom ignored paths are hard-blocked locally before network transit occurs.

Stateless Ephemeral API Routing

Kernax functions as a stateless orchestration layer, not a persistent code store:

• Zero Database Storage: We do not store your code snippets, prompt history, or AST tokens in persistent databases.
• Ephemeral Volatile RAM: Inflight payloads exist exclusively in volatile memory for the duration of the streaming response and are immediately purged upon completion.
• Key Isolation: Upstream provider API keys are managed centrally in our vault, eliminating the security vulnerability of distributing plaintext API keys across developer laptops.

Fireworks AI & OpenRouter Non-Training Guarantee

In our backend routing layer, every API payload dispatched to providers includes contractual non-training directives:

"provider": {
  "allow_fallbacks": true,
  "data_collection": "deny"
}

This strict programmatic flag ensures that upstream providers—including Fireworks AI and OpenRouter—automatically disable prompt caching, telemetry extraction, and foundation model fine-tuning on your intellectual property.

Cloudflare TLS 1.3 & Data Governance

All communications between the Kernax desktop client, our proxy gateway, and inference providers are encrypted in transit using Cloudflare TLS 1.3.

Kernax operates under strict data minimization principles. We collect only essential billing metadata (token counts and invoice records) required for account balance tracking. Your proprietary source code, prompts, and context are never logged, cached on disk, or sold.

For detailed legal terms and data processing commitments, consult our Security Architecture and Privacy Policy pages.