MCP connector operations and assurance
Updated 6 November 2026
/agent-integrations/mcp-connector/security/operations-and-assurance
MCP connector operations and assurance
The MCP connector runs inside TechWolf's security programme, which holds ISO/IEC 27001 and ISO/IEC 42001 certifications and SOC 2 Type 1 and Type 2 reports. Every change is reviewed and tested in staging before a release, and the reports and certificates are available on request at trust.techwolf.ai.
Availability
The connector runs as two instances in each region, and a release replaces them one at a time. Service levels are set in your agreement with TechWolf, and status is published at status.techwolf.ai.
Change management
- Every change is reviewed by another engineer and passes automated security scans of the code, the container image and its dependencies.
- Changes run first in a staging environment that holds only demo data, never customer data.
- A production release runs only after the change is deployed to staging and its checks pass. An engineer starts it, or the weekly security patch release does.
- The container runs as a non-root user and is rebuilt every week with current security patches.
- Secrets are held in a secrets vault. Each region has its own token-signing key.
How changes are announced
TechWolf announces changes to the tools or their data on MCP connector tools before they are released. The connector stays read-only. Anything that can change data will ship as a separate connector, with its own sign-in and documentation, announced in advance.
TechWolf security programme
| Area | TechWolf's position |
|---|---|
| Certifications | ISO/IEC 27001:2022, ISO/IEC 42001, SOC 2 Type 1 and Type 2 |
| Encryption | In transit: TLS 1.2 or higher. At rest: AES-256 with keys in AWS KMS, including the connector's database. |
| Staff access | Role-based and least privilege, SSO with MFA, reviewed every quarter, logged |
| People | Background checks for experienced hires; security awareness training from onboarding, based on role and risk |
| Secure development | Peer review, automated security scanning on every build, releases blocked on high or critical findings |
| Penetration testing | Yearly test by an independent third party, which includes the connector. A summary is available on request. |
| Vulnerability management | Critical vulnerabilities fixed within 15 days, high within 30 days |
| Incident response | Documented process; customers notified without undue delay, as set out in the DPA |
| Business continuity | Two availability zones per region; backups copied to a second region in the same jurisdiction; RTO 4 hours, RPO 24 hours |
| Privacy | GDPR. TechWolf acts as your processor under its Data Processing Agreement (DPA), which lists its service providers. Data protection officer: privacy@techwolf.ai. |
| Responsible AI | Governed under ISO/IEC 42001 |
Security questions: security@techwolf.ai. Privacy and data protection questions: privacy@techwolf.ai.