Privacy Policy

Last updated: 2026-09-23

The Fastweigh MCP server (this site) is an OAuth-protected bridge between AI clients that speak the Model Context Protocol and the Fastweigh GraphQL API. This policy explains what it stores and why.

What we store

• OAuth grant records: the authorized client, scopes, verified identity and an encrypted copy of the tenant API key or user service principal. The OAuth provider derives encryption keys from token material; storage records alone do not contain the material needed to decrypt those credentials.
• Browser authorization transactions: encrypted credentials, identity and OAuth attempt metadata in a short-lived server-side record. The browser holds a secure random binding cookie. Attempts expire after 30 minutes; credentials are removed from the transaction when consent is claimed. A short-lived encrypted completion result supports recovery from an interrupted response.
• Write proposals: encrypted snapshots of affected business records and relevant dependencies, requested changes, reference details, approval challenges and outcomes. These are stored separately from audit logs to support exact review, preservation checks and duplicate-write prevention. Proposal access is bound to the authenticated connection. Proposal records do not contain the upstream credential itself.
• Audit and operational logs: tenant and identity labels, operation names, code hashes, timing, response sizes, record/error counts, generic error categories and proposal lifecycle metadata. Tenant-key audit entries can include an eight-character key prefix. New audit records do not store raw code, raw GraphQL queries, variable values or response bodies.
• Rate-limit counters: short-lived per-connection and per-IP admission counters.

Data excluded from new audit records

• Usable tenant API keys, user service principals or passwords. Credentials needed for continued access are retained only in encrypted credential storage as described above; submitted passwords and temporary user login sessions are not persisted.
• The contents of your GraphQL queries, variables, or responses.
• Tenant business records. Encrypted proposal storage is a separate exception described above; it is not part of the audit log.

How data is used

Operational records support abuse detection, troubleshooting and reconciliation. The service runs on Cloudflare infrastructure and sends authorized queries and changes to Fastweigh. Query results and proposal summaries are returned to the AI client you connect; that client and its provider handle the returned data under their own policies. Upstream credentials are not included in model-facing tool results or the review app.

Retention

The daily cleanup targets audit rows older than 90 days and expired authorization transactions. Cleanup is best-effort and can be delayed by failures or batch limits. Earlier service versions recorded some raw request and error details; those historical rows remain subject to the same cleanup policy.

Write proposals expire after ten minutes. Cleanup removes expired proposals once they are more than 24 hours past expiry, except proposals still executing or with uncertain outcomes. Those are retained for reconciliation and are not automatically pruned. Expiry prevents approval even if cleanup has not run.

MCP access tokens have a one-hour lifetime and refresh tokens use a configured 30-day lifetime. Fastweigh independently manages service-principal validity. Contact Fastweigh support to revoke access or ask about retained records.

Contact

For privacy questions, contact support@fastweigh.com.