[Admin Guide] Spekit MCP Data Privacy & Security FAQs

Answers to the security and governance questions customers raise when evaluating the Spekit MCP Connector. This covers what is specific to the connector.

ℹ️ For Spekit's company-wide security posture, including the SOC 2 Type II report, infrastructure controls, and the vulnerability disclosure program, see the Spekit Trust Center.

1. Authentication and identity

How does sign-in work?

The connector uses OAuth 2.0 with the authorization code flow. Every connection requires you to sign in and consent. There is no machine-to-machine path that uses a Client ID and secret. PKCE (S256) is required on every authorization request. It is your own Spekit login, not a new identity to set up. The AI tool holds a scoped, revocable token, not a password.

How long do tokens last?

Each refresh cancels the prior token and issues a new one, which limits the exposure window if a token is compromised. Tokens are verified as RS256-signed JWTs against the identity provider's published JWKS endpoint, checking the issuer and audience claims. OAuth session state is encrypted at rest, using Fernet encryption, in the session store.

Can we disconnect it?

✅ Yes. Users or org admins can disconnect the connector at any time, the same as revoking any other OAuth grant.

2. Authorization and access control

Does the connector give users new access?

❌ No. It is a new way to reach access that already exists. Whatever your Spekit role already lets you see and do, the connector lets you do the same from your AI tool, and nothing more. This is enforced at the backend API layer, not just in the connector. A viewer-only user cannot create or change content through an AI tool, even by asking.

Some actions are limited by role regardless of which tools a user can reach. For example, only Account Admins, Team Admins, and Experts can change the external share setting on Team Hub content.

Do write actions require confirmation?

By default, yes, but the control sits in the AI tool rather than in Spekit. This works through the MCP standard. Each tool is labeled read-only or able to change data, and the AI tool treats anything not marked read-only as needing confirmation.

⚠️ Most AI tools let a user set an individual tool to always allow, which runs it without prompting. Confirmation is therefore a user-configurable behavior in the AI tool, not a control Spekit enforces. Some organizations can disable the always-allow option in their AI tool. Validate this in your own tool during evaluation.

Can the connector be restricted to read-only, independent of a user's role?

❌ Not today. Access control is based on the authenticated user's own Spekit role and permissions. A feature flag controls whether the connector is enabled for a company at all, but there is no setting that forces read-only independent of a user's role. Admins can control which specific tools people have access to, in the Connectors section within their AI tool.

Can the connector be scoped to specific Topics or Deal Rooms?

❌ No. Access is based on what the individual user can already see and do in Spekit.

Can the connector manage users or permissions?

❌ No. Adding users, changing roles, and changing access all stay in Spekit admin settings.

3. Data handling and retention

Is content passed through the connector used to train AI models?

❌ No. For any generative or foundation model, whether Spekit's or a third party's. Third-party generative model providers (Google Gemini as primary, OpenAI as backup) are contractually prohibited from training on customer data under Spekit's enterprise agreements. OpenAI does not retain API data for training. Content sent for generation is used for runtime inference only. Spekit does not build or train its own generative or foundation model, and does not use customer data to train generalized models, per Spekit's DPA.

Spekit does train a limited set of narrow, non-generative internal models: a retriever classifier, a moderator classifier, a reranker, and an embeddings model. These use Spekit content, chat questions and answers, and PII-redacted contextual data. Content handled through the connector may contribute to these. Each one outputs only a true or false value, a score between 0 and 1, or a vector embedding. None of them generate text, and they stay entirely within Spekit's environment.

What does the connector log?

The connector does not log the content of questions asked or answers returned. Logging is limited to operational metadata: which tool was called, success or failure, response time, and the calling user's identity, for usage tracking and audit.

What are the retention periods?

Retention at each AI provider (Anthropic, OpenAI, Gemini) is governed by that provider's own published data-retention terms, which Spekit does not control. A customer-configurable retention setting does not exist today.

What happens to content once it reaches the AI tool?

Once results are returned to the AI assistant, that content becomes part of your conversation with that assistant. From that point it is governed by the AI provider's own data-handling practices. This is true of MCP in general, not specific to Spekit.

Which AI sub-processors sit behind the connector's tool calls?

The current tool set uses only OpenAI, and only to create embeddings for new or updated content, the same as in the web app. The connector's tools call the same backend API as the website and extension, so no new or different sub-processors are introduced.

4. Governance on writes

Is there an approval step before content created through the connector appears in a Deal Room that is already shared?

There is no approval gate in the connector's tool path today. If your role allows creating Speks, content is created immediately when the action runs.

Can I check through the connector whether a Deal Room has been shared?

❌ Not today. The tool that lists Deal Rooms returns the room's id, name, share and internal links, the name of its Topic, and whether branding was applied at creation. Sharing status is not exposed through the connector. Check it directly in Spekit.

Can the connector share a Deal Room, or change who can open one?

❌ No. A Deal Room becomes viewable once it is shared, and that happens in the Spekit Hub (Web App). The connector cannot share a room, and cannot change a room's access controls, such as requiring an email address or limiting access to named people or domains.

Is there an audit log of connector tool calls for admins?

Partly. Tool-call events (caller, tool, timestamp, success or failure) are captured and kept. Today that data lives in Spekit's internal observability tooling, used for maintenance and support, rather than in a dedicated customer-facing view for the connector. In Spekit's existing analytics dashboard, activity from the connector is shown in context rather than broken out into a separate view.

5. Transport, hosting, and security coverage

How is traffic protected?

The connector is served over HTTPS only. It calls only Spekit's own first-party backend APIs over an internal network path. It uses the open MCP standard, not a proprietary integration, so a security team can validate the implementation against a publicly documented spec. All traffic is traced end-to-end for monitoring and incident investigation.

How is input validated?

All HTML content submitted through write tools is passed through server-side sanitization, using an allowlist of permitted tags and attributes. This prevents script injection through content created in an AI tool. Write operations are validated server-side. The connector does not treat client-supplied data as pre-validated, and rejects malformed requests with specific, actionable errors.

Is the connector rate limited?

✅ Yes. Rate limiting is enforced per session, and quota enforcement is validated to fire correctly across service instances.

Has the connector been penetration tested or included in a SOC 2 examination?

Spekit maintains a company-wide SOC 2 Type II report covering the platform and security controls. The MCP server itself has not yet had a dedicated penetration test. It is a lightweight layer that proxies requests to backend services, and those backend services have been independently penetration tested within the past year. The MCP server is in scope for the next security assessment.

Can the connector delete anything?

❌ No. There is no delete tool. Nothing in Spekit can be removed through the connector.

6. Which commitments are contractual

7. Policies and resources

Sub-processors are managed under Spekit's Vendor and Third-Party Risk Management program. Each one undergoes pre-engagement risk assessment and due diligence, is bound by a written DPA with data protection, confidentiality, and security obligations equivalent to Spekit's (per Art. 28(4) GDPR/SCCs), and is granted least-privilege, purpose-limited access to only the data required for its function. AI and LLM providers are contractually prohibited from training on customer data. Spekit audits sub-processors' cybersecurity programs annually, or more often if needed.