Data & Privacy Centre

MCP Guard holds personal data only where it is necessary to provide the service or comply with legal obligations. The categories below reflect the live schema.

Account email & credentials

Your email address, bcrypt-hashed password, and linked OAuth provider identifiers are stored in Supabase Auth (the auth.users table). Your email is your primary identifier across the platform.

Supabase Auth / MFA metadata

Session tokens, refresh tokens, last-sign-in timestamp, TOTP factor enrollments (factor id + friendly name; never the TOTP secret itself), and AAL (Authenticator Assurance Level) records are managed by Supabase Auth and scoped to your user id.

Tenant membership & role

When you sign up, a personal workspace (tenant) is automatically created and linked to your account in the tenant_members table, recording your tenant id, user id, and role (admin by default).

Assessment data

If you initiate an MCP-server assessment (via the Assessments dashboard page or the SDK), the assessment report stores the server URL, tool metadata, risk classification, and your user id as the initiating user. This data is tenant-scoped.

Agent-guardrail evaluation data

Audit-log entries for tool-call evaluations — action id, agent id, decision (allow / review / deny), matched rule, and a SHA-256 hash of the canonicalised payload — are stored in audit_logs, scoped to your tenant. Raw request parameters are not retained by default; only the hash. This data is yours as a tenant admin.

Billing contact data

Billing email, company name, and tax details are held by Stripe under their own privacy policy. We store only the Stripe customer id and subscription status in our tenant_subscriptions table.

Support correspondence

Emails sent to privacy@mcp-guard.ai or hello@mcp-guard.ai are retained only for as long as needed to resolve your inquiry.

Self-serve (audit log): From the Audit dashboard, use the export button to download your tenant's audit-chain entries as a JSON file. The export includes decision history, chain-sequence hashes, and timestamps.

Full data export: Email privacy@mcp-guard.ai with the subject line Data Export Request and the email address registered to your account. We will respond within 30 days with a structured export covering all personal data we hold under your user id and associated tenant.

Self-serve account deletion: Signed-in users can permanently delete their account — including their Supabase Auth record, tenant membership, assessment reports, and all tenant-owned data that cascades — from the Account settings page. This action is irreversible. You will be signed out immediately.

Email request: If you prefer, email privacy@mcp-guard.ai with the subject line Deletion Request and we will process it within 30 days and confirm by email.

Note: some data may be retained for a short period to satisfy legal obligations (e.g. tax records, fraud-prevention) even after account deletion. The Privacy Policy §7 describes our retention windows in full.