Lindy Data Handling

Overview

Lindy agents process data through triggers, LLM calls, actions, knowledge bases, and memory. Data flows through Lindy's managed infrastructure with AES-256 encryption at rest and in transit. This skill covers data classification, PII handling, prompt-level data controls, and regulatory compliance.

Prerequisites

• Understanding of data types processed by your agents
• Knowledge of applicable regulations (GDPR, CCPA, HIPAA)
• For HIPAA: Business Associate Agreement (BAA) with Lindy (Enterprise plan)

Lindy Data Architecture

Component	Data Storage	Retention
Tasks	Task inputs, outputs, step data	Visible in dashboard
Memory	Persistent snippets across tasks	Until manually deleted
Context	Per-task accumulated context	Task lifetime only
Knowledge Base	Uploaded files, crawled sites	Until manually removed
Integrations	OAuth tokens, connection data	Until disconnected
Computer Use	Browser session, screenshots	30 days after last use

Instructions

Step 1: Classify Data in Agent Workflows

Map what data each agent processes:

Data Category	Examples	Handling
Public	Product info, FAQs, pricing	No restrictions
Internal	Sales reports, meeting notes	Limit to authorized agents
Confidential	Customer emails, CRM data	Access controls + audit
Restricted	PII, PHI, payment data	Minimize exposure + compliance

Step 2: PII Controls in Agent Prompts

Add data handling instructions directly to agent prompts:

## Data Handling Rules
- Never include full email addresses in summaries — use "[name]@[domain]"
- Redact phone numbers in logs — show only last 4 digits
- Do not forward customer personal information to Slack channels
- When storing to spreadsheet, omit columns: email, phone, address
- If asked to share customer data externally, decline and escalate

Step 3: Knowledge Base Data Safety

Knowledge base files are searchable by the agent. Control what goes in:

DO upload:

• Product documentation
• FAQ articles
• Policy documents
• Public knowledge articles

DO NOT upload:

• Customer databases with PII
• Credentials or API keys
• Internal HR documents (unless agent specifically needs them)
• Financial records with account numbers

Resync considerations: KB auto-refreshes every 24 hours. If you upload sensitive content by mistake, remove it AND trigger a manual Resync.

Step 4: Secure Memory Usage

Agent memories persist across all future tasks. Be deliberate:

Safe memory: "Customer prefers email communication over phone"
Safe memory: "Billing questions should escalate to finance@company.com"

Risky memory: "John Smith's SSN is 123-45-6789"  ← NEVER store PII in memory
Risky memory: "API key for Stripe: sk_live_xxxx"  ← NEVER store secrets

Add to agent prompt:

## Memory Rules
- Never store personally identifiable information (PII) in memory
- Never store credentials, API keys, or passwords in memory
- Memories should contain preferences, patterns, and procedures only

Step 5: Computer Use Data Isolation

If using Computer Use (browser automation):

• Sessions persist for 30 days with saved credentials
• Enable Incognito mode for sessions handling sensitive data
• Use dedicated (not shared) computer assignments for sensitive agents
• Review screenshots captured during execution for data exposure

Step 6: Integration Account Isolation

• Authorize dedicated service accounts per agent (not personal accounts)
• Use Gmail with a team alias, not an individual inbox
• Create read-only database credentials where possible
• Revoke access immediately when an agent is decommissioned

Step 7: Regulatory Compliance

GDPR (EU Data Protection):

• Document what personal data each agent processes
• Ensure agents only process data with valid legal basis
• Implement data subject access/deletion capabilities
• Agent prompt includes "do not retain personal data beyond task completion"
• Review Lindy's data processing agreement

CCPA (California Consumer Privacy):

• Identify agents processing California resident data
• Ensure opt-out mechanisms exist for data processing
• Agent prompt prevents selling/sharing personal information

HIPAA (Healthcare):

• Enterprise plan with BAA in place
• Agents only access minimum necessary PHI
• No PHI in agent memory or knowledge base
• Audit trail enabled for all PHI access
• Agent prompt includes PHI handling restrictions

Step 8: Data Retention Management

Agent Prompt Addition:
## Data Retention
- Do not reference data from tasks older than 30 days
- Clear task context after each run (do not accumulate indefinitely)
- When updating memory, remove outdated entries
- Summarize customer interactions, do not store verbatim transcripts

Data Handling Checklist

• Each agent's data classification documented
• PII handling rules in every agent prompt
• Knowledge base audited for sensitive content
• Memory creation restricted (no PII, no secrets)
• Integration accounts isolated per agent
• Computer Use sessions set to dedicated + incognito where needed
• Regulatory compliance requirements mapped
• BAA in place if handling healthcare data
• Data retention policy defined and enforced in prompts

Output

Produce a data-handling record for each agent that identifies its data classification, permitted integrations, memory policy, retention decision, and the owner responsible for periodic review. Escalate restricted-data workflows that lack a documented legal basis, BAA, or deletion path before enabling them.

Examples

For a lead-routing agent, record customer email as confidential, prohibit it from agent memory and public Slack channels, limit the CRM integration to a service account, and retain only an aggregate routing metric. If the workflow starts processing health information, stop deployment until the Enterprise BAA and minimum-necessary controls are confirmed.

Error Handling

Issue	Cause	Solution
PII in Slack channel	Agent forwarded customer email	Add "never forward PII to Slack" to prompt
Sensitive file in KB	Uploaded by mistake	Remove file + trigger KB resync immediately
Memory contains PII	Agent auto-created memory	Delete memory + add "never store PII" to prompt
Audit finding	Agent accessing unnecessary data	Remove unused integrations from agent

Resources

• Lindy Security
• Lindy Privacy Policy
• GDPR Official
• Lindy Documentation

Next Steps

Proceed to lindy-enterprise-rbac for access control.