Security
How we handle the evidence we collect about your server.
A scan report is a map of your weaknesses. These are the facts about where it lives, who can read it and when it is deleted. Nothing here is a certification we do not hold.
Last updated
Where data is processed
The hosted service runs in AWS eu-west-2 (London, United Kingdom). The open-source CLI runs on your machine and sends nothing to us: no telemetry, no tool descriptions, no results. If you never create an account, we hold no data about your server at all.
What a hosted scan stores
- Evidence
- The request and response for each failed check, with bearer tokens and keys redacted before storage.
- Tool-list hash
- A SHA-256 of your canonical tool list, so the next scan can detect a changed description (META-02).
- Authorisation record
- Who authorised the scan, the verification proof, the scope, exclusions and rate cap.
- Credentials you supply
- Test tokens you pass with
--headerare used for one scan and redacted from all evidence.
Retention
Evidence is kept for 30 days on Free, 12 months on Team and 24 months on Business, then deleted. Authorisation records are kept for six years because they are the legal record that a scan was permitted. Cancelling a plan drops you to the Free limits at the end of the billing period; nothing is deleted for 30 days after that, so you can export it.
Third-party language models
Passive checks are rule-based. Your tool descriptions are not sent to any third-party model unless you switch on the optional judge for tool-description poisoning (META-01). When it is on, the provider is named in your account settings and in every report that used it.
Sub-processors
| Provider | Purpose |
|---|---|
| AWS | Hosting, scan runners and evidence storage |
| Neon | Database for accounts, targets and findings |
| Stripe | Billing for paid plans |
| Resend | Verification and scan-complete email |
The full list with regions is available on request from hello@mcpprobe.tech.
Encryption and access
TLS 1.2 or later in transit. AES-256 at rest, with evidence encrypted per account. Reports on Team and Business are private to the seats on that account; reports on Free are public by design, because the badge links to them.
What we do not claim
mcpprobe does not hold SOC 2 or ISO 27001 certification and does not display badges for either. When that changes, this page will say so with the auditor's name and the report date.
Status
Service availability will be published on the status page once hosted scanning opens.