Spekit MCP - Data Privacy & Security FAQs

How does sign-in work?

The connector uses OAuth 2.0 with the authorization code flow. Every connection requires you to sign in and consent. There is no machine-to-machine path that uses a Client ID and secret. PKCE (S256) is required on every authorization request. It is your own Spekit login, not a new identity to set up. The AI tool holds a scoped, revocable token, not a password.

How long do tokens last?

Access tokens expire after 24 hours. Refresh tokens have a 30-day lifetime and rotate on every use. Each refresh cancels the prior token and issues a new one, which limits the exposure window if a token is compromised. Tokens are verified as RS256-signed JWTs against the identity provider's published JWKS endpoint, checking the issuer and audience claims. OAuth session state is encrypted at rest, using Fernet encryption, in the session store.

Can we disconnect it?

✅ Yes. Users or org admins can disconnect the connector at any time, the same as revoking any other OAuth grant.

Does the connector give users new access?

❌ No. It is a new way to reach access that already exists. Whatever your Spekit role already lets you see and do, the connector lets you do the same from your AI tool, and nothing more. This is enforced at the backend API layer, not just in the connector. A viewer-only user cannot create or change content through an AI tool, even by asking.

Do write actions require confirmation?

✅ In practice, yes. Every write action is set up to prompt you for confirmation before it runs. This works through the MCP standard. Each tool is labeled read-only or able to change data, and the AI tool treats anything not marked read-only as needing your confirmation. The confirmation is enforced by the AI tool, not by a separate Spekit setting. We recommend validating the behavior in your own tool during evaluation. Not every write action has been seen to prompt in every tool and session.

Can the connector be restricted to read-only, independent of a user's role?

❌ Not today. Access control is based on the authenticated user's own Spekit role and permissions. A feature flag controls whether the connector is enabled for a company at all, but there is no setting that forces read-only independent of a user's role. Admins can control which specific tools people have access to, in the Connectors section within their AI tool.

Can the connector be scoped to specific Topics or Deal Rooms?

❌ No. Access is based on what the individual user can already see and do in Spekit.

Can the connector manage users or permissions?

❌ No. Adding users, changing roles, and changing access all stay in Spekit admin settings.

Is content passed through the connector used to train AI models?

❌ No. For any generative or foundation model, whether Spekit's or a third party's. Third-party generative model providers (Google Gemini as primary, OpenAI as backup) are contractually prohibited from training on customer data under Spekit's enterprise agreements. OpenAI does not retain API data for training. Content sent for generation is used for runtime inference only. Spekit does not build or train its own generative or foundation model, and does not use customer data to train generalized models, per Spekit's DPA.

Spekit does train a limited set of narrow, non-generative internal models: a retriever classifier, a moderator classifier, a reranker, and an embeddings model. These use Spekit content, chat questions and answers, and PII-redacted contextual data. Content handled through the connector may contribute to these. Each one outputs only a true or false value, a score between 0 and 1, or a vector embedding. None of them generate text, and they stay entirely within Spekit's environment.

What does the connector log?

The connector does not log the content of questions asked or answers returned. Logging is limited to operational metadata: which tool was called, success or failure, response time, and the calling user's identity, for usage tracking and audit.

What are the retention periods?

Within Spekit: access tokens for 24 hours, refresh tokens for 30 days, logs for 100 days, traces for 7 days, and metrics for 180 days. Retention at each AI provider (Anthropic, OpenAI, Gemini) is governed by that provider's own published data-retention terms, which Spekit does not control. A customer-configurable retention setting does not exist today.

What happens to content once it reaches the AI tool?

Once results are returned to the AI assistant, that content becomes part of your conversation with that assistant. From that point it is governed by the AI provider's own data-handling practices. This is true of MCP in general, not specific to Spekit.

Which AI sub-processors sit behind the connector's tool calls?

The current tool set uses only OpenAI, and only to create embeddings for new or updated content, the same as in the web app. The connector's tools call the same backend API as the website and extension, so no new or different sub-processors are introduced.

Is there an approval step before content created through the connector appears in a Deal Room that already has external sharing on?

There is no approval gate in the connector's tool path today. If your role allows creating Speks, content is created immediately when you confirm the action.

Can I check through the connector whether a Deal Room already has external sharing on?

❌ Not today. The tool that lists deal rooms returns id, name, and share and internal links. Sharing status is not exposed through the connector. Check it directly in Spekit.

Is there an audit log of connector tool calls for admins?

Partly. Tool-call events (caller, tool, timestamp, success or failure) are captured and kept. Today that data lives in Spekit's internal observability tooling, used for maintenance and support, rather than in a dedicated customer-facing view for the connector. In Spekit's existing analytics dashboard, activity from the connector is shown in context rather than broken out into a separate view.

How is traffic protected?

The connector is served over HTTPS only. It calls only Spekit's own first-party backend APIs over an internal network path. It uses the open MCP standard, not a proprietary integration, so a security team can validate the implementation against a publicly documented spec. All traffic is traced end-to-end for monitoring and incident investigation.

How is input validated?

All HTML content submitted through write tools is passed through server-side sanitization, using an allowlist of permitted tags and attributes. This prevents script injection through content created in an AI tool. Write operations are validated server-side. The connector does not treat client-supplied data as pre-validated, and rejects malformed requests with specific, actionable errors.

Is the connector rate limited?

✅ Yes. Rate limiting is enforced per session, and quota enforcement is validated to fire correctly across service instances.

Has the connector been penetration tested or included in a SOC 2 examination?

Spekit maintains a company-wide SOC 2 Type II report covering the platform and security controls. The MCP server itself has not yet had a dedicated penetration test. It is a lightweight layer that proxies requests to backend services, and those backend services have been independently penetration tested within the past year. The MCP server is in scope for the next security assessment, with penetration testing planned for the September to October window.

Is the connector hosted under the existing DPA?

✅ Yes. The MCP server is hosted on the same AWS infrastructure and region as the core platform, under the existing DPA.

Which promises are backed by contract.

• The no-training commitment for third-party generative models is contractual, under enterprise terms. 

• Spekit's commitment not to use customer data to train generalized models is contractual, under Spekit's DPA. 

• The narrow internal non-generative models are governed by Spekit's MSA and AI Addendum and by the DPA.

Links to the policies and the sub-processor program.