Privacy Policy — GoMobSec connector for Claude and other AI apps

This policy covers the GoMobSec MCP connector at mcp.gomobsec.ai (“the Connector”), operated by GoMobSec Inc. (“We”, “Us”). It lets Claude and other AI apps that support the Model Context Protocol use Your GoMobSec account. What happens to an application once it reaches GoMobSec is covered by the main GoMobSec Privacy Policy, which also applies.

What the Connector keeps

For each AI app You connect, We store:

• the key GoMobSec issues to the Connector when You approve the connection, encrypted (AES-256-GCM, under a key used only by the Connector and bound to that connection), with Your GoMobSec user ID and username;
• the AI app’s registration: its name and the addresses it asked to return to after sign-in;
• the access and refresh tokens issued to the AI app — stored only as one-way hashes, never in readable form;
• while a sign-in is in progress, its one-off codes (for up to ten minutes).

Our service logs also record connection IDs and AI app IDs when connections are made or ended, for security and troubleshooting. They do not record tool inputs or results.

What the Connector does not collect

The Connector does not receive Your conversations with the AI app, its memory or Your files. It sees only the tool calls the AI app makes — such as “list my scans” or “start a scan of this link” — and the values passed in them, and it keeps none of those after answering.

Apps You ask it to scan

When You ask the AI app to scan an app from a link, the Connector downloads it from that link into a private temporary file, sends it to GoMobSec under Your account, and deletes the temporary copy straight away. From then on it is Customer Application Data under the main Privacy Policy: encrypted at rest, analysed, and kept or deleted as described there.

How We use it

Only to run the Connector: to call GoMobSec as You, with Your connection’s own key, to check that Your plan includes this feature, and to keep the service secure. We do not sell it, use it for advertising, or use it to train models.

Who else sees it

• The AI app You connect (for example Claude, by Anthropic) receives the results of the tool calls it makes — scan lists, statuses and findings — and handles them under its own privacy policy.
• GoMobSec (the platform) receives the API calls and files, as described in the main Privacy Policy.

How long it is kept

• Revoking the “MCP connector: …” key on the API keys page in GoMobSec ends the connection; the Connector deletes it the next time the AI app uses it.
• Disconnecting in the AI app, if it tells the Connector, revokes the key and deletes the connection straight away.
• A connection the AI app has not used for 30 days is deleted automatically. Revoke its key in GoMobSec to deactivate the key itself.
• Access tokens expire after one hour; sign-in codes after ten minutes at most.
• Service logs follow the usage-data period in the main Privacy Policy.

Security

You approve every connection in GoMobSec yourself, after signing in as usual, and GoMobSec issues a key to the Connector directly. The AI app never sees that key: it gets its own short-lived tokens, which work only with the Connector. The Connector has no access to GoMobSec’s database; everything it does goes through the public API with Your key, so it can see only what Your account can see. Links to scan are fetched only over https from public internet addresses.

Your choices and rights

You can disconnect any AI app at any time. You can ask Us for a copy of, or the deletion of, data about You, and You have the rights set out in the main Privacy Policy. The Connector is not meant for anyone under 16.

Changes

We will update the date above when this policy changes.

Contact

Email support@gomobsec.ai.