lindy-data-handling
Data handling best practices for Lindy AI agents. Use when managing sensitive data in agent workflows, implementing data privacy controls, or ensuring compliance. Trigger with phrases like "lindy data", "lindy privacy", "lindy PII", "lindy data handling", "lindy GDPR", "lindy HIPAA".
What this skill does
# Lindy Data Handling ## Overview Lindy agents process data through triggers, LLM calls, actions, knowledge bases, and memory. Data flows through Lindy's managed infrastructure with AES-256 encryption at rest and in transit. This skill covers data classification, PII handling, prompt-level data controls, and regulatory compliance. ## Prerequisites - Understanding of data types processed by your agents - Knowledge of applicable regulations (GDPR, CCPA, HIPAA) - For HIPAA: Business Associate Agreement (BAA) with Lindy (Enterprise plan) ## Lindy Data Architecture | Component | Data Storage | Retention | |-----------|-------------|-----------| | **Tasks** | Task inputs, outputs, step data | Visible in dashboard | | **Memory** | Persistent snippets across tasks | Until manually deleted | | **Context** | Per-task accumulated context | Task lifetime only | | **Knowledge Base** | Uploaded files, crawled sites | Until manually removed | | **Integrations** | OAuth tokens, connection data | Until disconnected | | **Computer Use** | Browser session, screenshots | 30 days after last use | ## Instructions ### Step 1: Classify Data in Agent Workflows Map what data each agent processes: | Data Category | Examples | Handling | |--------------|---------|----------| | **Public** | Product info, FAQs, pricing | No restrictions | | **Internal** | Sales reports, meeting notes | Limit to authorized agents | | **Confidential** | Customer emails, CRM data | Access controls + audit | | **Restricted** | PII, PHI, payment data | Minimize exposure + compliance | ### Step 2: PII Controls in Agent Prompts Add data handling instructions directly to agent prompts: ``` ## Data Handling Rules - Never include full email addresses in summaries — use "[name]@[domain]" - Redact phone numbers in logs — show only last 4 digits - Do not forward customer personal information to Slack channels - When storing to spreadsheet, omit columns: email, phone, address - If asked to share customer data externally, decline and escalate ``` ### Step 3: Knowledge Base Data Safety Knowledge base files are searchable by the agent. Control what goes in: **DO upload**: - Product documentation - FAQ articles - Policy documents - Public knowledge articles **DO NOT upload**: - Customer databases with PII - Credentials or API keys - Internal HR documents (unless agent specifically needs them) - Financial records with account numbers **Resync considerations**: KB auto-refreshes every 24 hours. If you upload sensitive content by mistake, remove it AND trigger a manual Resync. ### Step 4: Secure Memory Usage Agent memories persist across all future tasks. Be deliberate: ``` Safe memory: "Customer prefers email communication over phone" Safe memory: "Billing questions should escalate to [email protected]" Risky memory: "John Smith's SSN is 123-45-6789" ← NEVER store PII in memory Risky memory: "API key for Stripe: sk_live_xxxx" ← NEVER store secrets ``` Add to agent prompt: ``` ## Memory Rules - Never store personally identifiable information (PII) in memory - Never store credentials, API keys, or passwords in memory - Memories should contain preferences, patterns, and procedures only ``` ### Step 5: Computer Use Data Isolation If using Computer Use (browser automation): - Sessions persist for 30 days with saved credentials - Enable **Incognito mode** for sessions handling sensitive data - Use **dedicated** (not shared) computer assignments for sensitive agents - Review screenshots captured during execution for data exposure ### Step 6: Integration Account Isolation - Authorize dedicated service accounts per agent (not personal accounts) - Use Gmail with a team alias, not an individual inbox - Create read-only database credentials where possible - Revoke access immediately when an agent is decommissioned ### Step 7: Regulatory Compliance **GDPR (EU Data Protection)**: - [ ] Document what personal data each agent processes - [ ] Ensure agents only process data with valid legal basis - [ ] Implement data subject access/deletion capabilities - [ ] Agent prompt includes "do not retain personal data beyond task completion" - [ ] Review Lindy's data processing agreement **CCPA (California Consumer Privacy)**: - [ ] Identify agents processing California resident data - [ ] Ensure opt-out mechanisms exist for data processing - [ ] Agent prompt prevents selling/sharing personal information **HIPAA (Healthcare)**: - [ ] Enterprise plan with BAA in place - [ ] Agents only access minimum necessary PHI - [ ] No PHI in agent memory or knowledge base - [ ] Audit trail enabled for all PHI access - [ ] Agent prompt includes PHI handling restrictions ### Step 8: Data Retention Management ``` Agent Prompt Addition: ## Data Retention - Do not reference data from tasks older than 30 days - Clear task context after each run (do not accumulate indefinitely) - When updating memory, remove outdated entries - Summarize customer interactions, do not store verbatim transcripts ``` ## Data Handling Checklist - [ ] Each agent's data classification documented - [ ] PII handling rules in every agent prompt - [ ] Knowledge base audited for sensitive content - [ ] Memory creation restricted (no PII, no secrets) - [ ] Integration accounts isolated per agent - [ ] Computer Use sessions set to dedicated + incognito where needed - [ ] Regulatory compliance requirements mapped - [ ] BAA in place if handling healthcare data - [ ] Data retention policy defined and enforced in prompts ## Error Handling | Issue | Cause | Solution | |-------|-------|----------| | PII in Slack channel | Agent forwarded customer email | Add "never forward PII to Slack" to prompt | | Sensitive file in KB | Uploaded by mistake | Remove file + trigger KB resync immediately | | Memory contains PII | Agent auto-created memory | Delete memory + add "never store PII" to prompt | | Audit finding | Agent accessing unnecessary data | Remove unused integrations from agent | ## Resources - [Lindy Security](https://www.lindy.ai/security) - [Lindy Privacy Policy](https://www.lindy.ai/privacy) - [GDPR Official](https://gdpr.eu/) - [Lindy Documentation](https://docs.lindy.ai) ## Next Steps Proceed to `lindy-enterprise-rbac` for access control.
Related in AI Agents
skill-development
IncludedComprehensive meta-skill for creating, managing, validating, auditing, and distributing Claude Code skills and slash commands (unified in v2.1.3+). Provides skill templates, creation workflows, validation patterns, audit checklists, naming conventions, YAML frontmatter guidance, progressive disclosure examples, and best practices lookup. Use when creating new skills, validating existing skills, auditing skill quality, understanding skill architecture, needing skill templates, learning about YAML frontmatter requirements, progressive disclosure patterns, tool restrictions (allowed-tools), skill composition, skill naming conventions, troubleshooting skill activation issues, creating custom slash commands, configuring command frontmatter, using command arguments ($ARGUMENTS, $1, $2), bash execution in commands, file references in commands, command namespacing, plugin commands, MCP slash commands, Skill tool configuration, or deciding between skills vs slash commands. Delegates to docs-management skill for official documentation.
reprompter
IncludedTransform messy prompts into well-structured, effective prompts — single or multi-agent. Use when: "reprompt", "reprompt this", "clean up this prompt", "structure my prompt", rough text needing XML tags and best practices, "reprompter teams", "repromptception", "run with quality", "smart run", "smart agents", multi-agent tasks, audits, parallel work, anything going to agent teams. Don't use when: simple Q&A, pure chat, immediate execution-only tasks. See "Don't Use When" section for details. Outputs: Structured XML/Markdown prompt, quality score (before/after), optional team brief + per-agent sub-prompts, agent team output files. Success criteria: Single mode quality score ≥ 7/10; Repromptception per-agent prompt quality score 8+/10; all required sections present, actionable and specific.
adaptive-compaction
IncludedAdaptive add-on policy and recovery layer that decides WHEN to compact, prune, snapshot, or fork -- replacing fixed-percent auto-compaction across Claude Code, Codex, and MCP-capable hosts. Trigger on auto-compact timing or damage: "when should I compact", "is it safe to compact now or start a fresh session", "auto-compact fires too early/mid-task", "switching to an unrelated task but the window still has space", "context rot", "answers get worse the longer the session runs", "the agent forgot the plan or my decisions after it summarized", "add a layer on top that manages context without changing the agent", raising autoCompactWindow to give the policy room, or installing/tuning a cross-tool compaction policy or PreCompact hook -- even when "compaction" is never said but the problem is context-window pressure or post-summarization memory loss. Do NOT use to summarize a conversation, build RAG, write a summarization prompt (decides WHEN not HOW), or answer max-context-length trivia.
agent-skill-creator
IncludedCreate cross-platform agent skills from workflow descriptions. Activates when users ask to create an agent, automate a repetitive workflow, create a custom skill, or need advanced agent creation. Triggers on phrases like create agent for, automate workflow, create skill for, every day I have to, daily I need to, turn process into agent, need to automate, create a cross-platform skill, validate this skill, export this skill, migrate this skill. Supports single skills, multi-agent suites, transcript processing, template-based creation, interactive configuration, cross-platform export, and spec validation.
llm-wiki
IncludedUse when building or maintaining a persistent personal knowledge base (second brain) in Obsidian where an LLM incrementally ingests sources, updates entity/concept pages, maintains cross-references, and keeps a synthesis current. Triggers include "second brain", "Obsidian wiki", "personal knowledge management", "ingest this paper/article/book", "build a research wiki", "compound knowledge", "Memex", or whenever the user wants knowledge to accumulate across sessions instead of being re-derived by RAG on every query.
skill-master
IncludedAgent Skills authoring, evaluation, and optimization. Create, edit, validate, benchmark, and improve skills following the agentskills.io specification. Use when designing SKILL.md files, structuring skill folders (references, scripts, assets), ingesting external documentation into skills, running trigger evals, benchmarking skill quality, optimizing descriptions, or performing blind A/B comparisons. Keywords: agentskills.io, SKILL.md, skill authoring, eval, benchmark, trigger optimization.