Sensitive fields - credentials, tokens, and other secrets you store in the platform - are encrypted at rest using AES-256-GCM before they are written to disk. Encryption keys are managed separately from the encrypted data.
All traffic to and from the platform is encrypted in transit with TLS. Authentication is handled through Keycloak using signed, short-lived JWTs; we never store your password.
Access to production data is limited to the engineers who need it to operate the service, and is scoped per-resource rather than granted broadly. Every credential you store is tied to your account and is not readable by other users or other organisations on the platform.
We run our infrastructure within the EU, apply security patches on a regular cadence, and monitor the platform for anomalous activity. Backups are encrypted with the same standard as production data.
The sub-processors we rely on - Keycloak (self-hosted) and Stripe - are chosen for their own security track record. Payment data never touches our servers directly; it is handled by Stripe, which is certified to PCI DSS.
If you believe you have found a security vulnerability in MCP Bundler, please report it to security@mcpbundler.com before disclosing it publicly. Include enough detail to reproduce the issue. We will acknowledge your report, investigate, and keep you updated on remediation. We will not pursue legal action against good-faith security research conducted under this policy.