Kyndex is the secure action layer that sits between your enterprise knowledge and AI execution, deployed inside your own infrastructure. Identity-aware retrieval, automatic PII redaction, human approval on every write action, and a complete audit trail, tuned to how your teams actually use their knowledge and tools. Your data never leaves your perimeter.
Most teams bolt AI onto existing systems and hope for the best. The reality is dangerous.
LLMs receive raw documents containing SSNs, email addresses, and financial data, exposing PII in responses and logs.
A sales rep queries the AI and accidentally retrieves confidential exec compensation or M&A documents they shouldn't see.
An agent sends a Slack message, creates a Jira ticket, or updates a CRM record with no human review or rollback capability.
Every query flows through identity checks, PII redaction, and access control before the LLM ever sees it. Every action requires human approval.
Every RAG query is scoped to the authenticated user's permissions. Personal, department, and organisation-wide documents are each retrieved only when the user has access, with no cross-tenant leakage.
Every document chunk is scanned before it reaches the LLM. SSNs, emails, credit card numbers, and custom PII types are masked automatically. Zero leakage into prompts, logs, or responses.
Every write action, from sending a Slack message to creating a Jira ticket or updating a CRM record, is queued for human approval with a full preview. A kill switch halts all actions instantly.
Adapts to the tools, models, and workflows you already have, and keeps proving it's working as you change them.
Encrypted access tokens stored per-user. Every RAG query filtered by the authenticated user's actual permissions, with no shared service accounts and no cross-tenant leakage.
Detects and masks SSNs, emails, credit cards, phone numbers, and custom patterns before any data reaches the LLM, automatically, on every query.
Every write action is queued for approval with a full preview. Read actions auto-approved by default. One-click kill switch stops all executions instantly.
Every retrieval, action, approval, and rejection logged with user context, timestamps, source documents, and execution results. Immutable. Exportable.
Unified layer that bridges knowledge retrieval with governed tool execution via MCP connectors. Register any HTTP endpoint as a tool and control it from the admin panel.
Granular two-layer roles: platform roles (super_admin, org_admin, member) and department roles (admin, member, viewer). Documents scoped to personal, department, or organisation. Data isolated per tenant by design.
Every answer references exactly which document, page, and chunk it came from. Full source transparency for compliance and user trust.
Built for non-blocking background processing. Document ingestion, action execution, and cleanup tasks run independently of the API, so nothing hits a request timeout.
Swap between OpenAI, Anthropic, Gemini, or a self-hosted Ollama model at runtime, with per-department budget caps and automatic downgrade rules to keep spend predictable.
Index content straight from Slack, Jira, Confluence, Notion, GitHub, and Google Drive, or push data in over a webhook. New sources show up in search without a re-deploy.
Build test suites of real questions and expected answers, then score answer relevancy and context precision from the admin dashboard before a change ever reaches your users.
REST API with full OpenAPI docs. Integrate Kyndex into any LLM stack, including LangGraph, CrewAI, or your own agent framework.
It takes months to get this right. We've done it for you.
| Capability | DIY / LangChain | Generic RAG SaaS | Kyndex |
|---|---|---|---|
| Identity-aware retrieval | |||
| PII auto-redaction | |||
| Human-in-the-loop approval | |||
| Department-scoped knowledge | |||
| Immutable audit trail | Partial | ||
| MCP action connectors | |||
| Built-in RAG evaluation | |||
| Multi-tenant RBAC | Partial | ||
| Citation tracking | Partial |
Kyndex retrieves only the contracts that user is authorized to view, redacts counterparty PII, and returns a cited summary with exact page references.
Kyndex retrieves Q3 data, masks any SSNs/bank details in the source, queues the Slack post for CFO approval with a full preview before sending.
Every query filtered by RBAC role. Engineers see their tier's docs. Security runbooks only visible to the security team. Full audit trail.
Employee names and identifying details auto-redacted before LLM summarization. Jira update queued for manager approval. Log retained for compliance.
No shared infrastructure. No per-seat lock-in. We deploy Kyndex directly into your environment, whether that's cloud, on-premises, or air-gapped, and you keep full ownership of the stack.
Deployed into your infrastructure with SSO, RBAC, and custom connectors set up for you.
A dedicated engineering contact, custom security review, and SLA-backed support for complex rollouts.
Kyndex is designed to run inside your infrastructure from day one. No shared tenancy, no data sent to us, no vendor lock-in.
Kyndex deploys directly into your Kubernetes cluster, on-premises servers, or private cloud. Your documents, embeddings, and agent logs never leave your environment.
We deploy Kyndex into your chosen infrastructure and handle day-to-day operations, updates, and monitoring, so your team stays focused on the product.
No shared infrastructure. No monthly per-seat billing. Kyndex runs inside your organisation, production-ready from day one, with identity, PII protection, approvals, and auditing built in.
Private deployment · Your infrastructure · Full control over your data