Data Protection

Axec Data Protection applies deterministic, server-owned detection profiles to mediated results. It runs after upstream execution and before result retention or client delivery.

It does not inspect upstream requests, alter provider data, or govern direct use of a released credential.

Configure a policy

A tenant policy has a stable key, active state, bounded target, one or more built-in detection profiles, a masking action, and an immutable revision. Targets may select MCP or proxy surface, Application, gateway, Connector, MCP capability, or normalized proxy method and path.

key: mask-crm-personal-data
active: true
target:
  surface: mcp
  connector: crm
  capability: contacts.search
profiles:
  - personal_data
action: mask

Treat this as an illustrative operator configuration shape. The server validates and publishes a complete new revision atomically. Unknown profiles, invalid targets, duplicate keys, unsupported actions, and exceeded bounds leave the active configuration unchanged.

Built-in profiles cover supported personal, health, payment-card, credential/secret, and OWASP sensitive-data-exposure recognizers. Multiple matching policies compose as the union of profiles; matched policy keys are recorded in deterministic order.

Verify masking

Invoke a matching MCP capability or mediated proxy operation using non-production test data. Confirm that:

• the normal protocol envelope and JSON structure remain intact
• detected values become deterministic category-labelled tokens
• already masked tokens remain stable
• proxy output contains only allowlisted safe response headers
• the retained ActionRequest result matches the sanitized client-visible result

MCP initialization and capability-list responses are not result bodies and are not transformed.

Failure behavior

Scan size, nesting, collection, decoding, and runtime cost are bounded. If a matching policy or detector cannot load, content cannot be decoded safely, or transformation fails, Axec withholds the result and returns data_protection_unavailable. It never falls back to the raw response.

If upstream mutation may already have happened, Axec records a terminal, non-replayable request and does not repeat the mutation merely because sanitization failed.

Retention

Only the complete sanitized result and safe metadata may be retained, within the existing result-retention limit. Raw bodies, detected values, pre-filtered headers, and detector samples are excluded. Temporary detector buffers and expired sanitized results are removed by bounded cleanup; secret-free evidence follows its own retention policy.

Profile names aligned to HIPAA, GDPR, CCPA, PCI DSS, or OWASP concerns are operational control mappings only. They are not certification, legal advice, a compliance guarantee, or a guarantee that every sensitive value will be detected.