Where time goes,
and where files go.
Kyro is an insider-risk ledger and device-fleet console for companies, and an automatic time tracker for individuals. It shows what left your organisation, through what, who did it — and how sure we are.
Free to start · macOS, Windows & Linux · self-hostable
Choose where you start
The same capture engine, tuned for very different jobs. Pick one now — your account type is set at sign-up.
Kyro Enterprise
An insider-risk / DLP ledger and an RMM-style device fleet console. Answer “what left, through what, who, and how sure are we” in seconds — and trust the answer.
- File-exit ledger: USB, AirDrop, uploads, git pushes, cloud shares
- Device fleet: enrol, assign, push managed config like an RMM
- Process mining, screenshots, SSO, audit log, retention
Kyro Personal
A private, automatic time tracker. Your day, reconstructed from the apps and sites you actually used — on your machine, under your control.
- Automatic time & activity tracking, no timers to start
- Your own screenshots and website history, private to you
- Use it without an org — or without an account at all
Every way a file can leave — one honest record
Kyro watches the real exit routes, attributes each one to an app, a person and a machine, and tells you how confident it is.
Removable storage
Files copied to USB are logged against the drive’s hardware serial — never its user-chosen name. Optional allow/deny enforcement.
AirDrop & shares
Outgoing AirDrop is read from the system log; uploads and cloud shares are attributed to the app and site in front at the time.
Git pushes
A push to an outside remote is recorded by host — company hosts are normal work and produce nothing. Observes only; installs no hooks.
Cloud audit logs
Google Workspace and Microsoft 365 sharing events that never touch the endpoint are pulled from the provider’s audit log.
Document beacons
Unguessable canary URLs embedded in documents record a coarse hit when a file is opened off-device. Revocable and audited.
Process mining
Granular, consented interaction capture discovers how work actually gets done versus the documented SOP.
Attribution honesty is the product
A competitor’s “risk score” that hides how it was derived cannot claim this. Everything Kyro asserts, it can show its work for.
Shown, not hidden
Monitoring is disclosed to employees with scoped consent. Agreeing to activity tracking is not agreeing to screenshots an admin turns on later — a wider scope asks again.
Counts, never contents
Input is counted, not identified: keystrokes are tallied, never logged. Sensitivity is judged from metadata — file contents are never read.
The basis of every claim
Each exit shows whether it was recorded by the OS, matched to a focused window, inferred, or unknown. An inference is never dressed up as an identification.
Locked down by default
Row-level security on every table, admin writes through audited service-role routes, secrets encrypted column-level. Operators of Kyro itself can never read customer data.
macOS first. Windows and Linux supported.
A tray app runs all day on each machine; the window opens briefly. Every capability states, per OS, exactly what it can and can’t do — no feature pretends to work where it doesn’t.
- Self-host the whole platform — one Supabase project, no third-party telemetry.
- Zero-touch MDM enrolment: devices self-enrol, the user never signs in.
- Managed config pushed to the fleet, with an approval workflow and audit trail.
- Works offline: the desktop keeps a durable queue and never drops your data.
See where your time and files really go
Start free. Add your organisation, enrol a device, and watch the first exits land in the ledger.