Version 1.0 - May 13, 2026
What this document covers
Demostack offers an MCP (Model Context Protocol) Connector that lets AI assistants such as Claude securely query a customer's Demostack data on behalf of a signed-in user. This document summarizes how the connector is secured and how customer data is handled.
SOC 2 compliance
Demostack maintains a SOC 2 compliance program covering the systems that operate the MCP Connector. SOC 2 attestation reports are available to customers under NDA on request.
Authentication & access control
Single sign-on via Okta. Every connection to the MCP Connector is authenticated through Demostack's enterprise identity provider, Okta, using the industry-standard OpenID Connect (OIDC) protocol. Users sign in with the same corporate credentials and SSO policies (MFA, conditional access, IdP rules) they already use for Demostack.
No passwords, API keys, or upstream identity tokens are shared with the AI assistant. Demostack's MCP server authenticates the user against Okta via OpenID Connect and holds the resulting Okta tokens server-side (encrypted at rest). The AI assistant only ever receives a short-lived OAuth access token issued by the MCP server itself, scoped to that user's session.
User-scoped access. The connector acts strictly on behalf of the signed-in user. It can only see data that the user is already authorized to see in Demostack — the same role-based permissions that apply in the Demostack web application apply to the MCP Connector.
Per-organization isolation. The connector validates the user's organization on every request, ensuring data from one customer tenant is never returned to another.
Data handling
Read-oriented access. The MCP tools are scoped to retrieving Demostack data for the user — they do not expose destructive operations.
Encryption in transit. All traffic between the AI assistant, the MCP Connector, and Demostack's backend is encrypted using TLS 1.2+.
Encryption at rest. OAuth tokens and client registrations stored by the connector are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256) before being persisted, on top of an encrypted database layer.
No customer data is sent to train AI models. Demostack does not use customer content from MCP queries to train any machine learning models. Data shared with the customer's AI assistant is governed by that AI vendor's terms (e.g., Anthropic's enterprise terms for Claude).
No long-term caching of customer content. The connector retrieves data on demand from Demostack's API for each request; it does not maintain its own copy of customer data.
Auditing & monitoring
Tool call logging. Every MCP tool invocation is logged with the user identity, organization, tool name, and timestamp, supporting audit and incident response.
Centralized monitoring. The MCP Connector is operated as part of Demostack's production platform under the same logging, alerting, and on-call processes covered by Demostack's SOC 2 controls.
Okta-based access revocation. Demostack staff can terminate MCP access through the Okta administrative console, which signs the user out and invalidates the OIDC/OAuth tokens stored by the MCP server. This prevents the server from refreshing credentials, effectively locking out the AI assistant once any existing short-lived tokens expire. Suspending or deactivating a user account in Okta has a similar effect.
Organization-level removal. When organization administrators remove a user from their organization, all subsequent MCP functionality for that user within that specific organizational scope is disabled.