At MCPcat, we take privacy and security seriously. We’ve built multiple layers of protection to ensure your users’ data remains secure and private throughout the entire analytics pipeline. MCPcat is co-founded by Naseem Al-Naji, creator of Opal, bringing years of experience in building privacy-first developer tools that handle sensitive data with the utmost care.

​
Client-Side Data Redaction

MCPcat provides powerful client-side redaction capabilities, allowing you to sanitize sensitive information before it ever leaves your environment. This ensures that sensitive data never reaches our servers.

​
How it works

You can provide a custom redaction function when initializing MCPcat tracking: 
import { mcpcat } from "@mcpcat/mcpcat-typescript-sdk";

mcpcat.track(mcpServer, "proj_YOUR_PROJECT_ID", {
  redactSensitiveInformation: async (text) => {
    // Redact email addresses
    if (text.includes("@")) {
      return "[REDACTED-EMAIL]";
    }
    
    // Redact credit card numbers
    if (/\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}/.test(text)) {
      return "[REDACTED-CC]";
    }
    
    // Redact API keys and secrets
    if (text.toLowerCase().includes("secret") || text.toLowerCase().includes("key")) {
      return "[REDACTED-SECRET]";
    }
    
    return text;
  }
});

​
Key Features

  • Recursive Application: Redaction is applied to all string values in event data, including nested objects and arrays
  • Protected Fields: Essential analytics fields (like sessionId, projectId, eventType) are preserved to maintain functionality
  • Type Preservation: Non-string values (numbers, booleans, dates) are preserved without modification
  • Error Handling: If redaction fails, the entire event is skipped to prevent accidental data leakage

​
Server-Side Privacy Protection

In addition to client-side redaction, MCPcat employs Microsoft Presidio on our servers to automatically detect and redact sensitive information that might have been missed by client-side filters.

​
Microsoft Presidio Integration

Our servers run every incoming event through a locally run Microsoft Presidio advanced PII detection engine, which identifies and redacts:
  • Personal Identifiers: Names, addresses, phone numbers, email addresses
  • Financial Information: Credit card numbers, bank account details, routing numbers
  • Government IDs: Social security numbers, passport numbers, driver’s license numbers
  • Medical Information: Patient IDs, medical record numbers
  • Custom Patterns: Domain-specific sensitive data based on your configuration

​
How it works

  1. Automatic Detection: Presidio analyzes all text fields in incoming events
  2. Context-Aware Redaction: Uses NLP to understand context and reduce false positives
  3. Configurable Sensitivity: Adjust detection thresholds based on your needs
  4. Audit Trail: Maintains logs of redaction actions for compliance purposes

​
Compliance & Certifications

MCPcat maintains the highest standards of security and compliance to protect your data.

​
SOC 2 Type II Compliance

We undergo annual SOC 2 Type II audits, demonstrating our commitment to:
  • Security: Protecting data against unauthorized access
  • Availability: Ensuring systems are operational and accessible
  • Processing Integrity: Ensuring data processing is complete, valid, and authorized
  • Confidentiality: Protecting confidential information
  • Privacy: Collecting, using, and disclosing personal information in accordance with our privacy policy

​
ISO 27001 Compliance

Our ISO 27001 compliance validates our Information Security Management System (ISMS), covering:
  • Risk Management: Systematic approach to managing sensitive information
  • Security Controls: 114 controls across 14 domains
  • Continuous Improvement: Regular audits and updates to security practices
  • Incident Response: Established procedures for security incidents
  • Employee Training: Regular security awareness training for all staff

​
Additional Security Measures

  • Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
  • Access Control: Role-based access control with principle of least privilege
  • Infrastructure Security: Hosted on SOC 2 compliant cloud providers
  • Regular Audits: Quarterly security assessments and annual penetration testing
  • Data Retention: Configurable retention policies with automatic data deletion

​
Disabling Telemetry

While MCPcat provides valuable analytics, we understand that some users may want to disable telemetry entirely. Since MCPcat doesn’t have a built-in disable flag, you can implement this in your MCP server by conditionally calling the track function.

​
Implementing Telemetry Control

Add environment variable support to your MCP server: 
import { track } from "@mcpcat";

// Check for telemetry opt-out
const telemetryEnabled = process.env.DISABLE_USER_ANALYTICS !== 'true';

// Only initialize tracking if telemetry is enabled
if (telemetryEnabled) {
  track(mcpServer, "proj_YOUR_PROJECT_ID");
}

​
Anonymizing User Sessions

For users who want analytics without user identification, implement anonymous mode: 
const anonymizeUsers = process.env.ANONYMIZE_SESSIONS === 'true';

// Override the identify function for anonymous mode
if (anonymizeUsers) {
  mcpcat.identify = async () => null;
}

​
Implementation Best Practices

  1. Document Environment Variables: Clearly document telemetry options in your MCP server’s README
  2. Default to Privacy: Consider making telemetry opt-in rather than opt-out
  3. Respect User Choice: Always check environment variables before initializing tracking
  4. Provide Granular Control: Allow users to disable specific types of tracking
Example implementation with multiple privacy options: 
const config = {
  telemetry: process.env.DISABLE_USER_ANALYTICS !== 'true',
  anonymize: process.env.ANONYMIZE_SESSIONS === 'true'
};

// Initialize MCPcat based on user preferences
if (config.telemetry) {
  const options: any = {};
  
  if (config.anonymize) {
    // Override identify to prevent user tracking
    options.identify = async () => null;
  }
  
  mcpcat.track(mcpServer, "proj_YOUR_PROJECT_ID", options);
}