ClosedMCP
Documentation

Security at ClosedMCP

ClosedMCP lets your company's AI apps use tools without handing them your keys. Here is how we protect that.

Sign-in and access

  • Sign in with Google. We never store passwords.
  • AI apps connect with OAuth and PKCE. Every tool call is checked against the caller's own permissions and your company's allow and deny rules, with approvals where you require them.
  • Removing a member revokes their access and tokens in one step.

Your secrets

  • Keys and tokens you give ClosedMCP are encrypted with AES-256-GCM before they are stored, each with its own random nonce.
  • AI apps never see your stored keys; ClosedMCP uses them on the app's behalf.
  • Our server storage is encrypted, and the unlock key is never written to disk.

Hosted apps are isolated

  • Apps you host on ClosedMCP run in gVisor sandboxes.
  • They have no internet access, cannot look up outside addresses, and cannot reach the cluster's control plane or other apps.
  • Each app gets its own database role. We run a live break-out test against the real cluster.

Infrastructure

  • Hosted on OVHcloud in the United States (Virginia).
  • HTTPS everywhere. A firewall allows only web traffic and key-based admin access.
  • Every code change runs automated tests; deploys only happen from the main branch, followed by a health check.
  • Nightly backups, with encrypted copies kept off-site for 14 days.

Visibility

  • Every tool call is logged: who, which tool, a hash of the arguments, and whether it was allowed. Your company sets how long logs are kept (90 days to 7 years; 1 year by default).
  • We check uptime and system health every five minutes.

Compliance

  • SOC 2: in progress. We are writing our policies and putting controls in place. We will share the report when it is ready.
  • GDPR: a Data Processing Agreement is available on request. See our privacy policy.

Report a vulnerability

Email security@canpai.io. Please include steps to reproduce. We will reply within 3 business days.

Please do not access other people's data, run denial-of-service tests, or make your finding public before we fix it. We will not take legal action against good-faith research that follows these rules.