Security overview

Security controls for XData’s MCP service.

Authentication

Connectors use OAuth 2.1; headless clients use bearer API keys. Browser sessions are signed after OAuth. Admin actions require an account-specific role, never a shared browser secret. Corpus reads require an authenticated session or valid API key during the private preview.

Data boundaries

We retain text and metadata; audio is deleted after on-device transcription. Public-source ingestion is separate from user identity except for usage and demand tracking.

Blocked source acquisition

A local agent fetches sources that block datacenter IPs. Its cloud endpoints require a shared token; without it, they return not-found.

Operational controls

Managed Postgres (pgvector) and a key-value store handle data and queues. Admin database access is IP-restricted. API keys are hashed and revocable. Ingestion status includes local-fetch stages.

Reporting

Report vulnerabilities or abuse via support page or security.txt.