Data, connections and downloads

10. Data handling, telemetry and retention

Independent local mode makes no OUTSEED telemetry calls and has no remote kill switch. Your MCP/AI client may transmit tool output to its configured AI provider. The result scrubber removes fields with secret-like names but is not a guarantee that all sensitive content is detected. Review evidence and client settings.

Hosted mode is explicitly opted in. Tool arguments/results are temporarily queued in OUTSEED D1, deleted after delivery or expiry, and are not saved as assessment history. Expired queue data is removed by the 15-minute scheduled job. Infrastructure credentials stay local; avoid supplying secrets as evidence.

OUTSEED records download starts, package/version, trusted source IP and approximate country/region/city when available. A 10-minute IP/browser/package/version window deduplicates retries; HEAD is not counted, range requests are served as full downloads, known bots are separated. Completion and installation are not measured.

Raw IP and detailed activity are retained for 30 days; non-identifying download aggregates and administrator/security configuration audit for 365 days. Administrator raw-data access requires identity confirmation and is audited. Independent mirrors/downloads outside OUTSEED cannot be measured.

11. Administration and malicious connections

The sole administrator can review client/connector origins, last heartbeat, state, account, platform and request metadata in Account → MCP administrator operations. Stale/offline is distinct from an active stored credential.

Quarantine denies new calls and polling. Terminate and revoke invalidates both hosted sides and cancels queued work; in-flight result delivery is denied after revocation. Suspending MCP service access affects all of that user’s hosted connections, without modifying their general OUTSEED account.

Temporary IP blocks expire after one hour; the administrator cannot block their own current IP. IP/location changes alone do not imply malicious behavior. Rate limits and authorization reject prohibited requests automatically; ambiguous activity requires administrator review.