Legal, Privacy & Security Overview

Built for teams that care about privacy, security, and compliance

MCP integrations often touch live customer data, critical workflows, and production systems. This page outlines how we approach privacy, security, data handling, and compliance for your AI infrastructure.

Security-first engineering

Principle of least privilege, secrets management, and hardened MCP deployments by default.

Customer data stays in your stack

We integrate with your infrastructure; we don't turn ourselves into another system of record.

Enterprise-ready posture

Designed to support GDPR-aligned deployments and common frameworks such as SOC 2 and ISO 27001.

Privacy policy (high-level)

This section summarizes how we typically handle data in MCP projects. Your final legal terms will be defined in the MSA, DPA, and project-specific SOW.

Role & responsibility

For most MCP implementations, you remain the data controller. We act as a service provider / processor to help you expose your existing systems to AI agents in a controlled way.

You retain ownership and control over your data and systems.
We access data only as necessary to design, implement, and support the integration.

Data categories

MCP projects can touch a range of data types depending on your systems:

• Business data (orders, tickets, inventory, internal docs).
• User metadata (names, emails, account IDs, roles).
• Operational logs (API calls, tool usage, error traces).

Sensitive or special-category data can be explicitly excluded or masked at design time.

This page is not a substitute for your formal privacy policy or DPA. Final terms, including legal roles and jurisdictions, must be captured in signed agreements.

Security overview

We design MCP architectures with security and blast-radius minimization as first-class goals.

Access & authentication

• OAuth2/OIDC integration with your identity provider (IdP) where applicable.
• Principle of least privilege for MCP tools and service accounts.
• Segregation of environments (dev / staging / prod) by design.

Infrastructure & deployment

• Containerized delivery (Docker/Kubernetes-ready templates).
• Network placement aligned with your existing architecture.
• Support for private networking and internal-only endpoints.

Monitoring & logging

• Structured logging for tool calls and error conditions.
• Optional audit logs for who-called-what-and-when.
• Integration with your SIEM / monitoring stack where required.

Data handling & retention

Clear expectations around where data flows, who can see it, and how long it is retained.

Data residency & storage

• MCP servers are deployed into your infrastructure or your chosen cloud accounts.
• We do not require copying your production database into our systems by default.
• Staging / demo datasets can be anonymized or synthetic where needed.

Region-specific deployment (e.g. EU-only) can be enforced by architecture.

Retention, logs, and deletion

• Implementation logs are retained only as long as necessary for delivery and support.
• Long-term retention policies for MCP logs follow your standards (configured per project).
• At the end of a project or on request, we can remove local copies of configuration or data samples.

Need a formal DPA (Data Processing Agreement) or SCCs? We can provide template language or review your standard addendum as part of contracting.

Compliance statements

MCP work often needs to align with existing governance frameworks. We design our delivery and architecture to fit into your compliance story, not fight it.

GDPR

• We can design deployments that keep personal data within EU-based infrastructure.
• Data minimization and purpose limitation are explicitly considered during tool design.
• Data subject requests can be supported by surfacing appropriate tools and logs.

SOC 2

• Our patterns align with common SOC 2 control expectations (access control, logging, change management).
• We can document architecture and data flows for your auditors.
• We can scope MCP into your existing SOC 2 boundary rather than creating a separate one.

ISO 27001 & other frameworks

• MCP architectures can be mapped cleanly to Annex A controls (access, operations, development).
• We help you document responsibilities split between your team, hosting provider, and us.
• Additional frameworks (HIPAA, PCI-adjacent constraints, etc.) can be assessed per project.

Important note

The statements above describe how MCP projects can be implemented in a compliant way. They do not in themselves constitute a certification or legal guarantee. Your exact compliance posture depends on your organization, your infrastructure, and the contracts we sign together.

Ready to implement MCP?

Share your technical requirements and we'll respond with a tailored implementation plan.