Privacy Notice
This notice explains what the Shufti MCP connector does with data when you connect it to an AI agent. It is written for Shufti customers and their authorized users, not for individuals being verified.
Effective date: 25 September 2026 · Version: 1.2
This supplements the Shufti Services Privacy Notice, which still governs all verification, biometric, AML, and document processing. Where this notice is silent, that one applies.
Our Role
| Data | Our role |
|---|---|
| Your API credentials and connector usage records | Controller — we decide how this is processed, for authentication, security, and support |
| Verification data passing through the connector | Processor, on your instructions. You remain the controller of your end users' data |
What We Process
| What | Details | Legal basis |
|---|---|---|
| Your API credentials | Your Secret Key is encrypted at rest and validated before being stored. Your Client ID is stored alongside it. Your account identifier is a one-way hash of your Client ID, not your name or email | Contract — UK GDPR Art. 6(1)(b) |
| Verification data | No document images, selfies, or other biometric data are accepted by the connector — those are captured on Shufti's hosted verification page instead, under an appropriate legal basis. What a tool can pass on is limited to what its check cannot run without: a name and date of birth for AML screening, an address for address verification, a phone number or email address for those checks, and company details for KYB. This is passed to the Shufti API and not stored by the connector — it is held in memory only for the duration of the request | Determined by you as controller |
| Usage records | Tool name, scopes, response status, your account identifier, a hashed IP, and your user agent. For a verification tool we record field names and a flag that a sensitive field was present, never the values. For a knowledge tool we record the question itself — its length and its first 120 characters — along with any industry, persona, competitor, or topic filter | Legitimate interests — Art. 6(1)(f) |
Your Secret Key is never shown back to you, returned to the AI agent, or written to logs.
The reference, country, and language values on a call are recorded in full, and the first 120 characters of a knowledge-tool query are recorded as written. The reference is yours to choose — do not put personal data in it, or in a question you ask the knowledge tools.
Hashed IP addresses are treated as pseudonymized, not anonymized. The IPv4 space is small enough to enumerate, so a hashed address can still be linked back to a real one.
Who Receives Your Data
Data reaches the AI agent's operator in both directions. Documents and selfies are the exception: the individual opens the hosted verification_url and submits them directly to Shufti, so they never enter the conversation. Everything else a tool needs — a name, date of birth, address, phone number, email address, or company details — reaches the connector through the agent.
Verification results are delivered into your AI agent's conversation, so its operator — Anthropic for Claude, OpenAI for ChatGPT — processes them. Results carry the verification status, the reference, decline reasons and codes, and AML outcomes. Data extracted from a document is not returned.
That platform is not our sub-processor. You choose which agent to connect, and its operator processes that data under your own relationship with them. Any transfer outside the UK and EEA that the operator makes is governed by that arrangement, not by us.
Where Shufti itself transfers personal data outside the UK and EEA, that transfer is appropriately supported by relevant safeguards, including but not limited to adequacy decisions, Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) backed by transfer risk assessments (TRAs), and Binding Corporate Rules (BCRs).
If sending data to the agent operator is not acceptable for a workflow, use the REST API directly instead.
We limit what is returned by construction: a status response is built from a fixed list of fields, so the provider's own payload, extracted document data, and identifiers such as the customer's email or country never reach your agent.
Retention
| Data | Retained |
|---|---|
| Access tokens | Expire after 24 hours; the record is deleted 7 days after expiry |
| Refresh tokens | Rotated on each use; the superseded token is deleted at that point |
| Authorization codes | Minutes — single use |
| Your encrypted Secret Key | Held in the token record and deleted with it |
| Usage records | Reviewed every 24 months from the date of the call |
| Verification data | Not retained |
Disconnecting does not delete the stored record. It stops your agent making calls, but the token and encrypted Secret Key are removed on the schedule above. To make stored credentials unusable immediately, rotate your keys in Backoffice → Settings → API Configuration → API Keys.
Security
- OAuth 2.1 with PKCE over HTTPS; unauthenticated requests to
/mcpare rejected. - Access and refresh tokens are stored only as hashes — we cannot recover the original.
- Your Secret Key is encrypted at rest.
- Scopes are enforced twice: when the tool list is issued, and again on every call. A knowledge-only connection cannot reach a verification tool.
- Document, selfie, and other image fields are stripped from every request before it reaches the Shufti API, so they cannot be submitted through a tool call even indirectly.
- Rate limiting on the authorization and token endpoints.
Connecting with "Explore Shufti" processes no verification data at all — no account, no API keys, and no calls to the Shufti API. Only the knowledge tools are available, answered from Shufti's own published product material. The questions you ask are still recorded as usage records, as described above.
Your Rights
- Rotate your credentials in Backoffice — the immediate control.
- Disconnect from your agent's connector settings at any time.
- Choose a narrower mode — connect with "Explore Shufti" if you only need product information.
- Control the callback destination with
callback_url; only domains registered in your Backoffice are accepted. - Raise a complaint — you can complain to the Information Commissioner's Office at ico.org.uk.
Your rights of access, rectification, erasure, restriction, portability, and objection are described in the Services Privacy Notice and exercised through the same contacts. They apply to the data described here.
Contact
Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF, United Kingdom, is the controller for credentials and usage records, and processor for verification data, as set out above.
For privacy questions or to reach our Data Protection Officer, use the contacts in the Services Privacy Notice. We update this notice when the connector changes in a way that affects it; the effective date above records the current version.