#MCP connector security FAQ

Short answers to the questions security reviews ask most about the MCP connector. Each answer links to the page with the detail.

#Data

#Does TechWolf see our prompts or chat history?

No. TechWolf receives only tool calls: the tool, its inputs and a one-sentence reason. See MCP connector data flow and hosting.

#Is the data a tool returns logged?

No. Call records, traces and error reports never hold returned data. See MCP connector storage and logging.

#How long does TechWolf keep call records?

400 days, inputs included, in your region. See MCP connector storage and logging.

#Does any data leave our region?

Market search terms go to TechWolf's US index of public job postings, without identity. The results the connector returns go to your AI tool, whose vendor processes them under your agreement with them. See MCP connector data flow and hosting.

#Can we get the logs?

Yes, as an extract of your organisation's call records, on request. There is no self-service export. See MCP connector storage and logging.

#Access

#Can someone see more through the connector than in the Console?

No. The same role, data categories and data roles apply, checked on every call. See MCP connector sign-in and access control.

#Can the connector change our data?

No. Every tool only reads. See MCP connector tools.

#What happens if a token is stolen?

It works for at most one hour, only on the connector and only with that person's access. Removing the person's role stops it at the next call. See MCP connector sign-in and access control.

#Can we use a shared service account?

No. Every call is made as one signed-in person. See MCP connector sign-in and access control.

#Can we switch off individual tools?

Not one by one. Data categories and data roles decide what each person can read, and the organisation switch turns the whole connector off. See MCP connector controls and shared responsibility.

#AI

#Does TechWolf train AI models on our data?

No. The connector runs no model and has no path to training. See MCP connector AI and threat model.

#How is prompt injection contained?

Every tool only reads, only what the person may see, and no tool can send data out, so an injected instruction has nothing to change and no way to move data out through the connector. See MCP connector AI and threat model.

#Is content scanned for sensitive data?

No. The connector returns only data the person may already see. See MCP connector AI and threat model.

#Assurance

#Is it penetration tested?

It is in scope of TechWolf's yearly penetration test by an independent third party. See MCP connector operations and assurance.

#Where are the certificates and reports?

At trust.techwolf.ai, on request: ISO/IEC 27001, ISO/IEC 42001 and SOC 2 Type 1 and Type 2. See MCP connector operations and assurance.