Trust center

Built to survive your IT reviewer

Universal coverage without a universal safety model is a liability engine. This page is the model: how identity works, how credentials are handled, what happens when you leave, and where we honestly say no. Forward it to whoever has to approve this.

Architecture principles

The rules everything else follows

One engine, one audit surface

Every connector executes on the same hardened runtime. There is no per-customer executable code: a connector is a declarative mapping that cannot express arbitrary computation, network calls to unlisted hosts, or credential access outside its own vault reference. The mapping schema is the security boundary, and it is versioned, validated, and reviewable.

Least privilege by construction

Upstream OAuth scopes are computed from the tools you enable, never a blanket grant. Disabling a tool can reduce scopes at the next re-auth. Expanding tools requires re-consent.

Writes are opt-in, previewed, and logged

No connector ships with writes enabled by default. Confirm-mode previews are delivered as human-readable diffs through the protocol's native Multi Round-Trip Requests, approved by the person who invoked the tool.

Graduated trust for machine-built connectors

Auto-built long-tail connectors launch with stricter defaults: writes confirm-only, destructive operations disabled, lower rate limits. They earn autonomy through human review or incident-free confirmed-write history. Build provenance is always visible.

Identity model

Chosen and disclosed, never discovered

Whose credentials does the connector use, and who does the upstream system think is acting? You choose the answer at build time, and we state it everywhere.

Team mode

The default wherever the upstream supports per-user credentials. Each member's connection carries their own upstream identity, so audit trails in your systems are truthful. Each connection's effective capability is the intersection of the connector's guardrails and that member's own upstream permissions: the AI can never exceed what the invoking person could legitimately do themselves.

Solo mode

One credential, one URL, disclosed in plain language at auth time, in the dashboard, and in the policy summary export: this connector acts as the connected account, and anyone using this URL acts as that account. We recommend a dedicated service account where the upstream supports one. Systems that only support a single org credential are Solo-only and badged as such at intake, never silently faked.

In both modes, each connection carries a distinct gateway token, so megamcp's own activity log preserves per-connection traceability even when the upstream sees a single account. On the client side, the gateway implements the hardened 2026-07-28 authorization profile: RFC 9207 issuer validation, issuer-bound credentials, and CIMD as the registration path.

Credential handling

Your keys, treated like keys

Encrypted at rest with KMS envelope encryption
Never logged, never returned by any tool
Decrypted only in-runtime at call time
Isolated per connector and per connection
Destroyed within 24 hours of cancellation, hard-deleted, not soft-deleted

Offboarding guarantees

Leaving is clean, and that is a promise

All connector URLs deactivate immediately on cancellation or trial expiry
Upstream OAuth tokens are revoked wherever the provider supports revocation
Stored credentials are destroyed within 24 hours
Activity logs remain exportable for 30 days, then purge
The same guarantee applies per member: revoking one connection deactivates that person's URL, revokes their token, and destroys their credential without touching anyone else

Prefer to keep your configuration? Pausing retains it and stops billing at the next cycle, as the alternative to deletion.

Activity log and redaction

Audit everything. Store only what you choose.

The activity log records every tool call: who, what, when, and result, with confirmation events captured per round-trip. It is immutable and exportable. What it stores about your business data is up to you.

Full arguments

Complete tool-call arguments, for teams that want maximum audit detail.

Field names only

Which fields were touched, with values redacted. The default for sensitive verticals.

Hashes only

Tamper-evident records with no argument content stored at all.

Logs are encrypted at rest, retained 90 days, and purged 30 days after cancellation. Log content is excluded from all analytics pipelines: only metadata such as tool name, status, and latency flows to internal analytics. Storage is single-region at v1, stated plainly.

Kill switches

The panic button is never more than one click away

User pause

One click, instant, for a whole connector or a single member's connection.

Global disable

Per-mapping shutdown for upstream incidents, applied across all affected customers at once.

Circuit breakers

Automatic tripwires on error storms and anomalous write bursts.

Regulated data

Where we honestly say: not self-serve

Systems that store PHI, consumer financial records, or similar regulated data are not self-serve in v1. We detect them at intake and route you to a compliance conversation with our done-for-you team, where BAAs and appropriate infrastructure commitments are handled per engagement. That is a trust posture, not a rejection: you get an honest path instead of a quiet liability.

Compliance conversations: customconnectors.ai Check your system at intake

Also available: DPA on request and a current subprocessor list. Every connector ships with a policy summary export covering scopes, enabled tools, safety modes, identity model, logging settings, build provenance, and protocol posture, built to forward to the person who approves tools like this.

Send this page to your reviewer

Then connect your software with a read-only trial. Evidence beats assurances.

Connect your software