Imported from jeremylongshore/tons-of-skills-marketplace (skills/.curated/lindy-data-handling/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill lindy-data-handling. Copyright stays with the author (MIT).

Lindy Data Handling

Overview

Lindy agents process data through triggers, LLM calls, actions, knowledge bases, and memory. Data flows through Lindy's managed infrastructure with AES-256 encryption at rest and in transit. This skill covers data classification, PII handling, prompt-level data controls, and regulatory compliance.

Prerequisites

• Understanding of data types processed by your agents
• Knowledge of applicable regulations (GDPR, CCPA, HIPAA)
• For HIPAA: Business Associate Agreement (BAA) with Lindy (Enterprise plan)

Lindy Data Architecture

Instructions

Step 1: Classify Data in Agent Workflows

Map what data each agent processes:

Step 2: PII Controls in Agent Prompts

Add data handling instructions directly to agent prompts:

## Data Handling Rules
- Never include full email addresses in summaries — use "[name]@[domain]"
- Redact phone numbers in logs — show only last 4 digits
- Do not forward customer personal information to Slack channels
- When storing to spreadsheet, omit columns: email, phone, address
- If asked to share customer data externally, decline and escalate

Step 3: Knowledge Base Data Safety

Knowledge base files are searchable by the agent. Control what goes in:

DO upload:

• Product documentation
• FAQ articles
• Policy documents
• Public knowledge articles

DO NOT upload:

• Customer databases with PII
• Credentials or API keys
• Internal HR documents (unless agent specifically needs them)
• Financial records with account numbers

Resync considerations: KB auto-refreshes every 24 hours. If you upload sensitive content by mistake, remove it AND trigger a manual Resync.

Step 4: Secure Memory Usage

Agent memories persist across all future tasks. Be deliberate:

Safe memory: "Customer prefers email communication over phone"
Safe memory: "Billing questions should escalate to finance@company.com"

Risky memory: "John Smith's SSN is 123-45-6789"  ← NEVER store PII in memory
Risky memory: "API key for Stripe: sk_live_xxxx"  ← NEVER store secrets

Add to agent prompt:

## Memory Rules
- Never store personally identifiable information (PII) in memory
- Never store credentials, API keys, or passwords in memory
- Memories should contain preferences, patterns, and procedures only

Step 5: Computer Use Data Isolation

If using Computer Use (browser automation):

• Sessions persist for 30 days with saved credentials
• Enable Incognito mode for sessions handling sensitive data
• Use dedicated (not shared) computer assignments for sensitive agents
• Review screenshots captured during execution for data exposure

Step 6: Integration Account Isolation

• Authorize dedicated service accounts per agent (not personal accounts)
• Use Gmail with a team alias, not an individual inbox
• Create read-only database credentials where possible
• Revoke access immediately when an agent is decommissioned

Step 7: Regulatory Compliance

GDPR (EU Data Protection):

• Document what personal data each agent processes
• Ensure agents only process data with valid legal basis
• Implement data subject access/deletion capabilities
• Agent prompt includes "do not retain personal data beyond task completion"
• Review Lindy's data processing agreement

CCPA (California Consumer Privacy):

• Identify agents processing California resident data
• Ensure opt-out mechanisms exist for data processing
• Agent prompt prevents selling/sharing personal information

HIPAA (Healthcare):

• Enterprise plan with BAA in place
• Agents only access minimum necessary PHI
• No PHI in agent memory or knowledge base
• Audit trail enabled for all PHI access
• Agent prompt includes PHI handling restrictions

Step 8: Data Retention Management

Agent Prompt Addition:
## Data Retention
- Do not reference data from tasks older than 30 days
- Clear task context after each run (do not accumulate indefinitely)
- When updating memory, remove outdated entries
- Summarize customer interactions, do not store verbatim transcripts

Data Handling Checklist

• Each agent's data classification documented
• PII handling rules in every agent prompt
• Knowledge base audited for sensitive content
• Memory creation restricted (no PII, no secrets)
• Integration accounts isolated per agent
• Computer Use sessions set to dedicated + incognito where needed
• Regulatory compliance requirements mapped
• BAA in place if handling healthcare data
• Data retention policy defined and enforced in prompts

Output

Produce a data-handling record for each agent that identifies its data classification, permitted integrations, memory policy, retention decision, and the owner responsible for periodic review. Escalate restricted-data workflows that lack a documented legal basis, BAA, or deletion path before enabling them.

Examples

For a lead-routing agent, record customer email as confidential, prohibit it from agent memory and public Slack channels, limit the CRM integration to a service account, and retain only an aggregate routing metric. If the workflow starts processing health information, stop deployment until the Enterprise BAA and minimum-necessary controls are confirmed.

Error Handling

Resources

• Lindy Security
• Lindy Privacy Policy
• GDPR Official
• Lindy Documentation

Next Steps

Proceed to lindy-enterprise-rbac for access control.