Secure, read-only MCP access to corporate data

Authentication and tenant isolation

• OAuth authorization code with PKCE S256; no OData API key for ChatGPT or Claude
• Validation of issuer, audience/resource, expiration date, scope, signature, algorithm and connection status
• Tenant derived solely from validated user and connection
• Withdrawal and amended allowlists will apply to the next tool call
• Viewers cannot authorize a remote connection

Data minimization

• A new connection only receives the explicitly chosen data set
• Each selected, filtered, sorted or grouped column is checked again
• Row, byte, time, and complexity limits limit results
• No sample rows in schema descriptions unless an administrator deliberately allows them later

Audit without business content

DigiData can record tool name, time, duration, counts, error category and correlation ID. Prompts, filter values, result rows and full responses do not belong in audit or analytics.

EU storage and the third-party provider exception

DigiData stores its own user and application data within the EU. An MCP command is a deliberate, client-authorized output: the chosen remote assistant can process or store a separate copy according to its terms. This exception applies in addition to the DigiData storage promise.

DigiData only returns data that is allowed for this connection and does not use customer questions or company data to train models. Once data is sent to ChatGPT, Claude or another chosen assistant, that provider processes its own copy under that provider's contract, subscription, settings and retention periods. DigiData therefore cannot promise that every configuration of an external assistant has the same data policy.

IP allowlisting

A cloud AI provider makes calls from its own infrastructure. The customer's browser IP cannot therefore be reused as an OData allowlist. MCP will have a separate tenant policy; OAuth and the connection allowlist remain mandatory.

Responsibilities and limitations

DigiData secures synchronization, tenant boundaries, connection authorization and read-only tools. The customer remains responsible for the chosen dataset, user roles, external workspace settings and business control of responses. A read-only connection prevents changes to the source, but does not make incorrect interpretation impossible.

Report a suspected security problem via info@digi-data.nl with time, safe error category and correlation ID. Do not share access tokens, company data prompts, or result rows by email.