Skip to main content
This page summarizes the connector for security, IT, and procurement review.

​
Authentication

  • Identity: single sign-on via your SAML 2.0 or OIDC-compliant identity provider — the same directory your TechWolf Console users sign in with.
  • Connector auth: OAuth 2.1 with PKCE, short-lived tokens scoped to your organization.
  • Access changes: every call is checked against Console permissions, so removing a user’s access takes effect on their next call.

​
The server

The connector serves data only, holds nothing between calls, and runs no AI model. Reasoning happens in your own AI assistant, under your contract with that provider.

​
Hosting

  • Region: pinned to a single AWS region, matched to your data residency requirement.
  • Network: outbound traffic is limited to AWS services, the named sub-processors listed in the DPA, and TechWolf’s data products.
  • Encryption: TLS 1.2+ in transit, AES-256 at rest.

​
Retention

  • Workforce data: kept for the life of your contract, deletable on request.
  • Chat history: governed by your own agreement with your AI assistant’s provider.
  • Operational logs (caller, tool, reason): aggregate use only.

​
MCP gateways

Some organizations route their AI assistants’ MCP connections through a central proxy, an MCP gateway, to keep control over which connections exist and who uses them. The connector is a standard remote MCP endpoint — streamable HTTP with OAuth 2.1, PKCE, and Dynamic Client Registration — and is designed to work behind any gateway that forwards each user’s own login rather than a shared service credential. The identity the gateway forwards must come from the same directory your TechWolf Console users sign in with, since permissions are keyed on that identity. TechWolf confirms compatibility with your specific gateway before rollout.

​
Prompt injection

The connector is read-only and every tool has a fixed destination inside TechWolf. No tool can fetch an arbitrary URL, send data, or change anything, so an injected prompt has nothing to modify and no way to move data out through the connector.

​
Certifications and compliance