Privacy Notice
This notice explains what the Shufti MCP connector does with data when you connect it to an AI agent. It is written for Shufti customers and their authorized users, not for individuals being verified.
Effective date: 28 August 2026 · Version: 1.1
This supplements the Shufti Services Privacy Notice, which still governs all verification, biometric, AML, and document processing. Where this notice is silent, that one applies.
Our Role
| Data | Our role |
|---|---|
| Your API credentials and connector usage records | Controller — we decide how this is processed, for authentication, security, and support |
| Verification data passing through the connector | Processor, on your instructions. You remain the controller of your end users' data |
What We Process
| What | Details | Legal basis |
|---|---|---|
| Your API credentials | Your Secret Key is encrypted at rest and validated before being stored. Your Client ID is stored alongside it. Your account identifier is a one-way hash of your Client ID, not your name or email | Contract — UK GDPR Art. 6(1)(b) |
| Verification data | Document images, faces, names, dates of birth, addresses, phone numbers, and company details are passed to the Shufti API and not stored by the connector — they are held in memory only for the duration of the request | Determined by you as controller |
| Usage records | Tool name, scopes, response status, your account identifier, a hashed IP, and your user agent. Request contents are redacted: we record field names and a flag that a sensitive field was present, never the values | Legitimate interests — Art. 6(1)(f) |
Your Secret Key is never shown back to you, returned to the AI agent, or written to logs.
The reference, country, and language values on a call are recorded in full. The reference is yours to choose — do not put personal data in it.
Hashed IP addresses are treated as pseudonymized, not anonymized. The IPv4 space is small enough to enumerate, so a hashed address can still be linked back to a real one.
Who Receives Your Data
Data reaches the AI agent's operator in both directions. Document images and selfies are uploaded into the agent's conversation before the connector calls Shufti. The limits below apply only to what we return.
Verification results are delivered into your AI agent's conversation, so its operator — Anthropic for Claude, OpenAI for ChatGPT — processes them. Those responses can include verification status, decline reasons, AML matches, and data extracted from documents.
That platform is not our sub-processor. You choose which agent to connect, and its operator processes that data under your own relationship with them. Any transfer outside the UK and EEA that the operator makes is governed by that arrangement, not by us.
Where Shufti itself transfers personal data outside the UK and EEA, that transfer is appropriately supported by relevant safeguards, including but not limited to adequacy decisions, Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) backed by transfer risk assessments (TRAs), and Binding Corporate Rules (BCRs).
If sending data to the agent operator is not acceptable for a workflow, use the REST API directly instead.
Where we can, we limit what is returned: status responses are summarized by default, truncated if oversized, and have image payloads replaced with a placeholder.
Retention
| Data | Retained |
|---|---|
| Access tokens | Expire after 24 hours; the record is deleted 7 days after expiry |
| Refresh tokens | Rotated on each use; the superseded token is deleted at that point |
| Authorization codes | Minutes — single use |
| Your encrypted Secret Key | Held in the token record and deleted with it |
| Usage records | Reviewed every 24 months from the date of the call |
| Verification data | Not retained |
Disconnecting does not delete the stored record. It stops your agent making calls, but the token and encrypted Secret Key are removed on the schedule above. To make stored credentials unusable immediately, rotate your keys in Backoffice → Settings → API Configuration → API Keys.
Security
- OAuth 2.1 with PKCE over HTTPS; unauthenticated requests to
/mcpare rejected. - Access and refresh tokens are stored only as hashes — we cannot recover the original.
- Your Secret Key is encrypted at rest.
- Scopes are enforced twice: when the tool list is issued, and again on every call. A knowledge-only connection cannot reach a verification tool.
- Rate limiting on the authorization and token endpoints.
Connecting with "Explore Shufti" processes no verification data at all — no account, no API keys, and no calls to the Shufti API. Only the knowledge tools are available, answered from Shufti's own published product material.
Your Rights
- Rotate your credentials in Backoffice — the immediate control.
- Disconnect from your agent's connector settings at any time.
- Choose a narrower mode — connect with "Explore Shufti" if you only need product information.
- Control the callback destination with
callback_url; only domains registered in your Backoffice are accepted. - Raise a complaint — you can complain to the Information Commissioner's Office at ico.org.uk.
Your rights of access, rectification, erasure, restriction, portability, and objection are described in the Services Privacy Notice and exercised through the same contacts. They apply to the data described here.
Contact
Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF, United Kingdom, is the controller for credentials and usage records, and processor for verification data, as set out above.
For privacy questions or to reach our Data Protection Officer, use the contacts in the Services Privacy Notice. We update this notice when the connector changes in a way that affects it; the effective date above records the current version.