Privacy and data boundaries
See what remains on your machine, what can be sent to configured providers, and how Kensa protects stored credentials.
Kensa is a desktop review application. Kensa does not run review agents in the cloud. Reviews are started as local processes through the agent CLI you configure, using your local clone or the pull request context available to the desktop app.
Understand where data goes
| Surface | What Kensa does |
|---|---|
| Desktop review engine | Builds review context and starts the configured CLI on your machine. |
| Agent CLI | Receives the review prompt and may read the configured review scope. The agent CLI may send the review context to its own provider under your account. |
| Source-control and tracker integrations | Use the connected account to fetch or publish the operation you request. |
| Website | Provides downloads, documentation, and account pages; it does not execute desktop reviews. |
That boundary matters: local execution is not the same as an offline review. Before reviewing a sensitive repository, assess the data-handling terms, model, account, and network behavior of the CLI provider you choose.
Protect access on this device
Kensa stores the desktop session and integration credentials with Electron secure storage. It refuses to persist a credential in plaintext when OS secure storage is unavailable. On supported systems, the encrypted credential data is bound to the operating-system account, so copying its stored ciphertext to another machine or account does not make it usable there.
Keep your own account permissions narrow and revoke an integration connection when it is no longer needed. Do not paste tokens, passwords, or private keys into agent focus fields, skills, learnings, finding comments, or support text.
Review scope and local copies
A local clone is required for Deep Review, Source Control, and worktrees. Deep Review gives agents repository read context so they can inspect code beyond the diff; its local access prompt or launch note tells you what will be read before the run. For a smaller review surface, use a Quick Review or apply repository path filters.