> For the complete documentation index, see [llms.txt](https://docs.autommate.com/userguide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autommate.com/userguide/administration-and-runtimes/security-and-data-handling.md).

# Security, access and data handling

Configure security around the accounts, execution hosts and connected systems involved in your service. Use this guide for the operational checklist, and the official policies for contractual and privacy terms.

## Separate the access layers

| Layer                  | Configure and review                                                           |
| ---------------------- | ------------------------------------------------------------------------------ |
| Autom Mate user        | Named account, role and permitted modules/resources                            |
| MSP customer context   | Intended tenant and the resources available to the operator                    |
| Application connection | Target environment, identity, authentication method and required operations    |
| Runtime host           | Service account, local files, network paths and script permissions             |
| AI or MCP client       | Approved provider/account, connected Autom Mate identity and intended tool use |

Start with [Users and Roles](/userguide/administration-and-runtimes/manage-users-and-access.md) and [application credentials](/userguide/integrations-and-api/apps-connections-and-authentication.md). Give each account the access needed for its work. Test a permitted operation and a corresponding restricted operation using the intended account and tenant.

## Handle credentials and logs deliberately

Store connection secrets in the supported credential configuration. Use descriptive names without secret values. Custom Credentials include an **Is Masked?** setting; also inspect diagnostic output before sharing it, because actions and scripts may return their own data.

Keep passwords, API keys, secret-bearing webhook URLs and private certificate keys out of AI conversations, shared examples and screenshots. For troubleshooting, capture the environment, component version, execution identifier, timestamp and sanitized error. Review both inputs and outputs before sending a log outside the authorized team.

## Review the data path

A local Mate Agent provides a local execution point. Review separately where configuration, input/output data, logs and connected application records are processed and retained. Include any AI provider or other external service used by the workflow.

For customer-managed infrastructure, assign responsibility for TLS certificates, host access, storage protection, backup and log retention. Use [network planning](/userguide/administration-and-runtimes/network-and-connectivity.md) and [certificate management](/userguide/administration-and-runtimes/certificates-and-tls.md) to validate the connections. The applicable [DPA](https://www.autommate.com/data-processing-addendum/) sets out processing responsibilities and security measures; its hosting commitments should be read with the actual deployment and selected-service arrangements.

## Connecting an external AI client

When you authorize MCP access, tool results can be returned to the selected client and become part of its conversation or records. Review the provider's account plan, retention, training settings and processing location. Autom Mate account permissions and the exposed tools determine the available access.

Use the connection controls in the AI client to disconnect. Request assistance with revocation when needed, and manage already returned information through that provider's retention/deletion controls. See the [MCP & AI Connector Usage Policy](https://www.autommate.com/mcp-ai-connector-policy/) and [MCP setup](/userguide/mcp-and-ai-reference/connect-an-ai-client-with-mcp.md).

## Official information and support

| Resource                                                                        | Use it for                                                 |
| ------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| [Trust Center](https://app.eu.vanta.com/autommate/trust/83od73119lysd6jwzr60)   | Available security assurance documents and access requests |
| [Privacy Policy](https://www.autommate.com/privacy/)                            | Personal-data practices and privacy contact information    |
| [Data Processing Addendum](https://www.autommate.com/data-processing-addendum/) | Customer-data processing and contractual safeguards        |
| [EULA](https://www.autommate.com/eula/)                                         | Product usage terms                                        |
| [MCP policy](https://www.autommate.com/mcp-ai-connector-policy/)                | Customer-enabled MCP access and selected AI services       |

For a technical access or configuration issue, contact **<support@autommate.com>** with sanitized evidence. Use the contact process in the relevant policy for privacy or contractual requests.