Home / Admins / Insights / Data Collection and Privacy

Data Collection and Privacy

AI Insights helps your organization understand how AI tools are being used, without collecting the contents of AI conversations. When AI Insights is turned on, Kolide collects selected types of usage and configuration metadata, like AI tool usage, MCP server configurations, Git repository details, and plain-text secrets in .env files.

Data collection for AI Insights follows these key principles:

Collection is opt-in and configurable. You choose whether to turn on AI Insights and are given an explanation of the categories of data Kolide will collect to populate this Insight.
Conversation contents are not collected. Kolide measures AI tool usage through counts and metadata, not by reading prompts, responses, conversation titles, summaries, or data sent to or returned from tools.
Secret values are not transmitted. When Kolide detects secrets in files, it reports metadata such as rule, file path, line number, and label (for example, README_API_PROD_KEY). The plain-text secret value never leaves the device.
Sensitive MCP configuration fields are excluded. Kolide does not collect MCP arguments, headers, or environment variables, which can contain API keys, OAuth tokens, and other credentials.

Data collection controls

To use AI Insights, turn on the AI Insights feature toggle. This makes AI Insights available in Kolide.

Turning off the AI Insights feature toggle doesn’t stop AI-related data collection. To stop collecting AI Insights data, turn off the relevant settings in Device Data Collection.

You can manage data collection for the following settings, to enable the AI Insights feature all four are required:

Setting	Controls
AI Tool Usage	Tracks usage of AI tools across desktop apps, CLIs, and IDE extensions.
Browser Usage	Checks browser history for visits to AI tools.
Code Repositories	Inventories Git repositories and connects them to AI usage.
Plain-Text Secrets Check	Checks for unencrypted `.env` files, SSH keys, and plaintext secrets that AI tools may be able to access, managed separately for each organization.

AI tool usage

Kolide collects usage metadata for supported AI tools to help your organization understand how AI is being used, without reading prompts or responses.

AI tool usage: What’s collected

Kolide counts how many times a user interacts with an AI tool each day, grouped by where the interaction happened, like desktop app, CLI, IDE, extension, or browser. For supported tools, Kolide also records the associated working directory or project path.

AI tool usage: What’s not collected

Prompt content: Kolide doesn’t read or transmit user messages, assistant responses, or data sent to or returned from tools. Usage is based on message counts from local databases or conversation file metadata.
Model selection: Kolide doesn’t record which AI model was used in a conversation.
Conversation content or titles: Kolide doesn’t access thread titles, summaries, or message content.

AI tool usage: How it works

For desktop apps and CLIs, Kolide’s agent checks local SQLite databases or JSON conversation files and counts messages where the role is user. For browser-based tools, the agent checks browser history for visits to known AI tool URLs and only daily aggregate counts are sent.

AI tool usage: Turn data collection off

Note:

AI Tool Usage and Connected Services is required by AI Insights. You’ll need to turn off the AI Insights feature toggle first if you want to turn off AI Tool Usage and Connected Services data collection.

To turn data collection off for AI Tool Usage and Connected Services:

Select your profile in the top-right corner of Kolide, then select Settings.
In the sidebar, select Device Data Collection.
Turn off AI Tool Usage and Connected Services.

MCP server configurations

Kolide inventories MCP server configurations for supported AI tools. This helps your organization understand which external services and integrations AI tools may be configured to access.

Kolide collects basic configuration details for each MCP server, like the server name, connection method, whether it’s turned on, and which AI tool the configuration belongs to.

MCP server configurations: What’s collected

For each supported MCP server configuration, Kolide collects:

Field	Description
`server_name`	The user-assigned name of the MCP server, like `Figma` or `Slack`.
`command_or_url`	The command or endpoint used to connect to the server, such as `npx` or an HTTPS URL.
`transport`	The connection type, such as `stdio` or `http`.
`enabled`	Whether the MCP server is currently enabled.
`config_file_path`	The path to the configuration file on the device.
`interaction_surface`	The AI tool or surface the configuration belongs to, such as Cursor, Claude Code, or Goose.

MCP server configurations: What’s not collected

Arguments, flags, and headers: Kolide doesn’t collect command-line arguments or header values from MCP configurations. These can contain sensitive values, such as API keys or authorization tokens.
Environment variables: Kolide doesn’t read environment variable blocks, which are commonly used to pass API keys or OAuth tokens.
Request or response content: Kolide doesn’t observe or collect data sent through MCP connections.

MCP server configurations: How it works

Kolide’s agent reads MCP configuration files used by supported AI tools and collects only specific top-level configuration details. Nested configuration blocks, such as arguments, environment variables, and headers, are excluded.

Only MCP inventory metadata is sent to Kolide. The contents of MCP requests and responses are not collected

MCP server configurations: Turn data collection off

Note:

To turn off MCP server configuration data collection, turn off the AI Insights feature toggle. Then you can turn off AI Tool Usage and Connected Services data collection, which controls MCP server configuration data.

To turn data collection off for MCP server configurations:

Select your profile in the top-right corner of Kolide, then select Settings.
In the sidebar, select Device Data Collection.
Turn off AI Tool Usage and Connected Services.

Git repositories

Kolide inventories local Git repositories and links them to AI tool usage when the recorded working directory or project path is located inside a repository.

Git repositories: What’s collected

Field	Description
`path`	The local filesystem path of the repository, such as `/Users/jane/git/acme-api`
`raw_remote_origin`	The repository’s `origin` remote URL from its Git config

Git repositories: Privacy considerations

Repository collection may surface personal or non-work repositories on the device. Kolide links AI tool usage to a repository only when the AI tool’s working directory is inside that repository.

Git repositories: What’s not collected

File contents: Kolide doesn’t read or transmit source code, diffs, commit messages, or file contents from files in the repo, except for the following cases:
- .git/config: Kolide reads this file to retrieve the remote origin URL of the repository.
- .env: Environment variables are scanned on-device for plain-text secrets using Gitleaks-based rules. If a secret is discovered, only the label of the secret, such as NPM_TOKEN, is transmitted back to Kolide. No secret values are transmitted.
Commit history: Kolide doesn’t collect individual commits, authors, or branch names.
Uncommitted changes: Kolide doesn’t transmit the contents of your working tree or staging area back to Kolide for storage.

Git repositories: Turn data collection off

To turn data collection off for Code Repositories:

Select your profile in the top-right corner of Kolide, then select Settings.
In the sidebar, select Device Data Collection.
Turn off Code Repositories.

Plain-text secrets

AI Insights checks the device for sensitive data that AI tools may be able to access, such as .env files, SSH keys, and other plaintext secrets.

When sensitive data is detected, Kolide records metadata about the finding, but not the secret value itself.

Plain-text secrets: What’s collected

For each detected plain-text secret, Kolide collects:

Field	Description
`env_file_path`	The full path to the `.env` file.
`env_file_size`	The file size in bytes.
`env_file_modified_at`	The file’s last modified timestamp.
`secrets_in_file`	The number of distinct secret findings in the file.
`json_env_entries`	A JSON array with details about each finding.

Each finding in json_env_entries may include:

Field	Description
`rule_id`	The detection rule that matched, such as `aws-access-key-id` or `github-pat`.
`description`	A human-readable description of the rule.
`line_number`	The line where the secret was found.
`entropy`	A score that helps indicate whether the matched value looks like a secret.
`label`	The plain-text label of the environment variable, such as `README_API_PROD_KEY`.

Plain-text secrets: What’s not collected

Secret values: Kolide doesn’t collect the actual API key, password, token, or other plaintext secret value. Only metadata about the finding is recorded.
Non-secret key-value pairs: .env files with no detected secrets aren’t reported.

Plain-text secrets: Configuration options

Administrators can customize this Check to reduce false positives. For example, they can exclude specific paths, such as extension directories, or disable the generic API key rule.

AI Insights also uses the Check’s configuration to determine which .env findings to collect and show in the dashboard. For example, if the Check is configured to exclude paths containing a particular string, findings from those paths are not included in the AI Insights dashboard.

Plain-text secrets: Turn the Check off

You can disable the “Plain-Text Credentials - Require Encrypted Storage of Sensitive .ENV Files” Check for your organization. Disabling the Check stops enforcement and user-facing remediation prompts, but does not stop the underlying query. Kolide continues to scan for and collect .env secret metadata on devices.

Data accuracy and limitations

AI tool usage counts are best-effort estimates based on data reported by each tool. Because tools track and expose usage differently, counts may be approximate, incomplete, estimated, or unavailable, and should not be treated as exact measurements or compared directly across tools.

Encoded or binary history formats

Some AI tools store conversation history in formats Kolide can’t parse with standard queries, such as proprietary, binary, or encrypted files. In these cases, Kolide may estimate usage based on file metadata, such as file count, file size, or last modified date, instead of counting individual messages.

Incomplete local history

Some AI tools don’t keep a full history of user interactions on the device. They may sync conversations to the cloud, keep only recent history locally, or delete local history after a restart or retention period. When this happens, usage counts only reflect the history available on the device at the time of collection.

Browser-based usage

For AI tools used in a browser, usage is based on browser history visits rather than message-level activity. A single visit could represent a long session, a quick page load, or no meaningful interaction. If browser history is cleared, past visits may no longer be available.

Multi-device and shared accounts

Usage is collected per device. If a user accesses the same AI tool on multiple devices, each device reports separately. Kolide doesn’t remove duplicate usage records across devices for the same user account.

Newly supported tools

When Kolide adds support for a new AI tool, past usage is captured only if the tool’s local history files still contain that data. Kolide doesn’t backfill usage from cloud services.