Privacy Policy

The short version

Passport is a governed gateway between your team's AI clients (Claude, Cursor, ChatGPT, and the like) and the MCP servers they reach. Its core privacy property is that upstream credentials never land in an AI client's configuration; Passport holds and brokers them server-side. That means Passport necessarily stores those credentials, so most of this policy is about how they are protected, how little else we keep, and how you get it all back or deleted.

We do not sell your data, we do not run advertising or tracking, and we do not send marketing email. If the code and this policy ever disagree, the code is the source of truth and the disagreement is a bug we want to hear about.

Who is the controller and who is the processor

For the content inside your workspace (members, credentials, policies, and activity), your organization is the data controller and Passport is a data processor acting on your instructions. Your workspace admins decide what to connect, who can use it, and what is retained within the limits below.

For the account and billing data we need to run Passport as a business (the identity of the admin who signs up, workspace-level contact details, and the subscription record held by our payment processor), Passport is the controller. This policy covers both roles.

"Passport," "we," and "us" mean Ramish Syed, carrying on business as Passport, based in Alberta, Canada, the operator of the passportmcp.com service. You can reach us at hello@passportmcp.com.

What we collect

Early-access requests. If you join the early-access list, we retain the work email you submit, the submission source and time, and an opaque lead ID so an authorized operator can follow up. The address is encrypted at rest. A versioned keyed blind index, rather than an enumerable email hash, prevents duplicate requests without exposing the address in operational alerts or logs.

Account and identity. Member name, work email, title, department, role (admin or member), and an avatar color, plus your workspace name and settings. This comes from self-serve signup, OAuth sign-in with Google or GitHub, or SCIM provisioning from your own identity provider.

Workspace configuration. Which MCP servers you have connected, the access passes and per-tool policies your admins set, guardrail rules, and team structure.

Opt-in Desktop discovery. When you enable Passport Discover, Desktop scans supported local AI-client configuration and keeps sensitive inspection on your computer. Enterprise workspaces receive the authenticated installation and member identifiers, installation label, client, safe MCP name, transport class, remote hostname or safe executable class, whether protected settings were detected, and scan timestamps and status. We do not upload config paths, commands or arguments, environment values, headers, tokens, endpoint paths, query strings, prompts, files, tool inputs or outputs, or traffic. A complete remote endpoint is sent only after you explicitly review and confirm a migration.

Activity metadata. For each tool call routed through the gateway we record who made it, from which AI client, which server and tool, the outcome (ok, blocked, or error), latency, and a short summary of up to the first three arguments. Each summarized value is clipped to 360 characters and secrets caught by a guardrail are redacted before anything is written. We do not store full tool arguments, tool results, or your AI prompts and completions.

Encrypted upstream credentials. The OAuth access and refresh tokens members grant to MCP servers, the company API keys or auth headers an admin supplies to run a connector as a shared account, and your identity-provider secrets. These are encrypted at rest and are never shown back in full or handed to an AI client.

Billing. If your workspace is on a paid plan, our payment processor (Stripe) holds your subscription and payment details and gives us the plan, seat count, status, and renewal date. We never see or store full card numbers.

Operational diagnostics. Standard server logs plus privacy-filtered server/browser errors, route/status/latency traces, logs and metrics, MCP app/tool/client identifiers and outcomes, and opaque member/workspace IDs in Sentry. Browser session replay is intentionally disabled until its URL metadata can be guaranteed not to serialize query strings or fragments before scrubbing.

What we deliberately do not store

Full tool arguments, tool results and response payloads, and your model conversations. Data returned by an upstream MCP server passes through the gateway to your AI client and is not persisted. Passport never sees the prompts or completions in the model conversation, only the tool calls a client chooses to make.

Raw long-lived tokens that authenticate to Passport itself. Web sessions, bridge refresh tokens, and agent keys are kept only as one-way SHA-256 digests; the raw value is shown once at creation and cannot be recovered from storage.

Sensitive observability payloads. Collection of request and response bodies, query strings, cookies, authorization headers, database statements, MCP inputs and outputs, and AI content is disabled. Passport does not deliberately attach names or email addresses; email-like values, token patterns, and credential-bearing paths found in diagnostic data are redacted or normalized before transmission.

Desktop's process-keyed scan token and the raw configuration value it represents. They remain in the running Desktop process only, are used to prevent stale or ambiguous local edits, and are never uploaded or restored from local storage.

Why we use it, and our legal basis

We use the data above to provide the gateway, authenticate people, enforce the access and guardrail policies your admins set, show you the activity and audit trail, send the transactional email the service depends on, bill paid plans, and keep the service secure and reliable.

Where the law asks for a legal basis (for example under the EU and UK GDPR), we rely on: performance of our contract with you (running the workspace and billing it); our legitimate interests in operating, securing, and improving the service in ways you would reasonably expect; and compliance with legal obligations. In Canada, our handling is grounded in PIPEDA and the consent implied by using a governed gateway for the purposes described here.

We do not send marketing email today, so we do not process your data for marketing. If that ever changes, it will be separate, opt-in, and consent-based, and you will be able to decline without losing the service.

How long we keep it

Early-access requests are retained for at most 365 days from submission so we can complete requested onboarding follow-up, then the encrypted address, keyed indexes, authority event, and undelivered notification state are deleted together. We delete a request sooner when the requester asks us to do so.

High-frequency client-presence and health signals are pruned after 2 days. Each client's latest activity timestamp and audit-class events (tool-call activity, admin audit entries, alerts, and tool-change records) are kept for 90 days and then pruned. Pruning runs on startup and every 10 minutes after that.

Identity, workspace configuration, encrypted credentials, and Enterprise Discover inventory are kept for as long as the workspace exists. A source that has not reported for 7 days stops counting as current coverage, but its last finding remains visible rather than being silently treated as removed. Deleting the workspace erases these records immediately, as described next. Billing records held by Stripe follow their own retention, since we are required to keep certain financial records.

Restricted disaster-recovery backups are retained for no more than 30 days. Deletion removes data from the active database immediately but cannot rewrite an older immutable snapshot; those copies age out on schedule and are accessed only for recovery. Before a restored snapshot may serve traffic, deletion records newer than that snapshot are reapplied so an erased workspace cannot return.

Privacy-filtered Sentry diagnostics are retained according to our Sentry plan and organization settings, separately from Passport's database pruning. They contain opaque IDs and operational metadata and are configured to exclude workspace content and credentials.

Deletion and your controls

If you joined the early-access list, contact hello@passportmcp.com to access or delete that request. Authorized operators resolve it only through its opaque lead ID; deletion removes the encrypted address, every keyed deduplication alias, its authority event, and queued delivery state in one operation.

Disconnecting a connected app deletes its stored credential. Revoking a member's sessions, a bridge credential, or an agent key stops the token from validating immediately. Removing a member revokes their sessions everywhere, drops their connected-account grants, and purges their Discover sources, connection occurrences, and owner context.

Deleting the workspace (from Settings, guarded by typing the workspace name) permanently erases everyone, every credential, all policies, and all activity from Passport's database. The workspace document and its entire event log are purged, not soft-deleted. Previously emitted privacy-filtered Sentry diagnostics age out under Sentry's separate retention; contact us to request earlier deletion.

Admins can export the workspace at any time: activity and audit trails as CSV or JSONL, and a full workspace backup as JSON.

Subprocessors

We keep the list of infrastructure providers that may process workspace data short and current on the Subprocessors page. Today that is Railway (application hosting and the managed Postgres database), Cloudflare (DNS and CDN in front of the app), Resend (transactional email), Stripe (payments), GitHub (desktop app release distribution), and Sentry (privacy-filtered operational observability). Resend and Stripe only process data on deployments where an admin has turned on email or billing.

Beyond those, the only other places data flows are the integrations your own admins configure: the upstream MCP servers your team connects, your identity provider for SSO or SCIM, and any SIEM endpoint or alert webhook you point us at. Sentry is used only for reliability and security diagnosis, not advertising or cross-site tracking.

Where your data is processed

The hosted service and its subprocessors run in the United States. If you or your members are located elsewhere, including Canada, the United Kingdom, or the EEA, using Passport means your data is transferred to and processed in the United States.

Our published standard Data Processing Addendum and Standard Contractual Clauses address the applicable transfer mechanism for customers who need formal processing terms or transfer safeguards.

How we protect it

Early-access email addresses are encrypted with the same rotatable AES-256-GCM keyring. Deduplication uses a keyed HMAC blind index with explicit versions and rotation aliases, so a database copy cannot be used to enumerate likely addresses. Operational notifications contain only a random lead ID; retrieving or deleting the address requires a separate operator bearer credential and responses are marked no-store.

Upstream secrets (OAuth tokens, company API keys and auth headers, and identity-provider secrets) are encrypted at rest with AES-256-GCM under a rotatable key. In production the server refuses to boot without an encryption key, so secrets are never written in plaintext. Passport-issued tokens are stored only as SHA-256 digests.

All traffic is over HTTPS, and outbound calls to upstream MCP servers use TLS. In production, before dialing any admin-supplied URL we run SSRF checks that resolve the hostname and refuse private, loopback, link-local, and cloud-metadata addresses, re-validated on every redirect.

Every workspace is its own isolated document with its own persistence scope and write lock; one tenant's request can never read or write another's data, and that isolation is exercised by an end-to-end test on every commit. The full posture, including what we have not earned yet, is on the Security page.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Passport is built to honor these: access and export are self-serve for admins, correction is available from workspace settings, and deletion is real.

Because most workspace data is controlled by your organization, workspace members should route requests about that data through their own admin, who has the tools to act on it. For account data we control, or if you cannot reach your admin, contact us directly and we will help. We will not charge for reasonable requests and we do not retaliate for exercising a right.

To make a request or raise a concern, email hello@passportmcp.com. If you are in a jurisdiction with a data-protection authority, you also have the right to complain to it.

Cookies and tracking

The public marketing and catalog pages set no cookies and load no third-party scripts, analytics, or tracking pixels. Once you sign in, Passport sets a single first-party cookie to keep you signed in; it is HttpOnly, SameSite-restricted, and marked Secure in production. That is the only cookie we use. The signed-in app sends privacy-filtered operational diagnostics to Sentry, but there are no advertising or cross-site tracking cookies anywhere on the service.

Children

Passport is a workplace product and is not directed at children. It is not intended for anyone under 16, and you must be at least 16 (and old enough to enter a contract where you live) to use it.

If something goes wrong

If we become aware of a security incident affecting your data, we will acknowledge it to affected workspace admins within 2 business days and keep you updated through the fix. To report a vulnerability, email security@passportmcp.com; more detail is on the Security page.

Changes to this policy

We may update this policy as the product grows. Material changes get notice by email to workspace admins and a dated entry in our changelog, and the effective date above always reflects the current version.

Contact

For any privacy question, data request, or complaint, email hello@passportmcp.com. For security reports, use security@passportmcp.com.