Security and privacy

Personal access tokens

• PATs belong to one user in one organization and are checked against live membership and role on every request.
• Only owners and admins can use Developer Access. Losing membership, being banned, or being demoted below admin permanently revokes the PAT.
• Choose the narrowest scope and shortest practical expiry. Revoke a token immediately if it may have been exposed.
• Elicitra stores only a public lookup id and SHA-256 digest; the full PAT is shown once.
• Never place a PAT in source control, project MCP configuration, logs, screenshots, tickets, or prompts.

Tenant isolation

Every MCP query and mutation includes the authenticated organization predicate. A foreign identifier behaves exactly like a missing identifier. Tool discovery is filtered by scope and tool calls repeat authorization independently.

elicitra_knowledge_search reads a shared, customer-safe product-reference bundle and never an organization’s scenario Knowledge Base. Application logs omit its query and returned documentation text as well as all other MCP arguments.

Webhook destination safety

Elicitra resolves and validates all A/AAAA records on every delivery, rejects private, loopback, link-local, metadata, and reserved networks, pins a validated public IP while preserving TLS SNI/Host, and never follows redirects. Security violations disable the endpoint.

Endpoint URLs, signing secrets, and event payloads are encrypted at rest. Delivery logs omit full URLs, headers, response bodies, PATs, signatures, and personal data.

Controller responsibilities

For respondent campaign data, the platform customer is controller and Elicitra is processor. Configure only endpoints and downstream systems approved for the campaign purpose. Apply access control, retention, deletion, and data-subject workflows to the copy you receive.

Elicitra can cancel pending deliveries and delete retained ciphertext during a data-subject or organization deletion. It cannot recall copies already accepted by your endpoint.