Hosting & data
A check contains your agent's tool call and the user's request, which can be sensitive. Here is where it goes and what we keep.
Where a check runs
| Part | Meaning |
|---|---|
API edge | Cloudflare (api.mcp-guard.ai): authentication, rate limiting, validation and billing. |
Inference | Our GPUs in Switzerland. The model runs there; no third-party model API is called. |
Account data | Supabase, EU (Zurich region): your account, workspaces, API key hashes, credit balance and usage records. |
What we keep
| Data | Meaning |
|---|---|
Payloads | Not stored. The action, intent, context and conversation you send are used to answer the request and then dropped. |
Metadata | Kept 30 days: request id, API key id, endpoint, status or error code, latency, number of checks and credits charged. It powers the usage view and billing. |
API keys | Only a hash and a short prefix are stored; the full key is shown once when you create it. |
Details, sub-processors and your rights are in the privacy policy. Questions: support@mcp-guard.ai.
Sending less
The model reads about 384 tokens per check, so a long conversation or a full document adds little. Send the tool call, the user's request and a line of context. Redact secrets in arguments when the decision does not depend on them (the guard needs to know an email is being sent to an outside address, not the API token in the header).