Privacy — Resourced PLM connector

How the connector at https://mcp.resourced.com handles your data. It is operated by Resourced as part of the Resourced PLM, and it is covered by the same agreement your organisation already has with us for the PLM itself — this page describes what the connector specifically does.

What it handles

• An API key for this connection. Created when you approve it, as you, from the PLM session you are already signed in to. It is scoped to what an agent may call, expires after 365 days, and is not any of your other keys.
• Your brand's data. Whatever the assistant reads or changes on your behalf, at https://app.resourced.com, limited to the brands your own account can reach and to endpoints approved for agent use.
• What the assistant tried to do. The tool it called, the brand, whether it worked, how long it took, its one-line description of what it was doing, and any script it ran.
• Files you upload through an upload link, on their way to the PLM.

What is stored, and where

This server has no database. Specifically:

• The key is never written down. It is encrypted (AES-256-GCM) into the access and refresh tokens your client holds, and decrypted in memory for the length of a request. Your client cannot read it, we keep no copy, and the PLM itself stores only a hash — the key exists in clear exactly once, in the response that created it.
• Sessions live in memory and end when the connection closes, after 12 idle hours, or when the server restarts.
• Upload links expire after 30 minutes. The bytes pass through memory to the PLM and are not retained here.
• Data read from the PLM is never retained. It is returned to your assistant and forgotten.

Logs

We keep an operational record of what was attempted — the fields in the third bullet above, plus the fact that a session opened and which client opened it. It exists so we can see where the connector fails people and fix it.

Deliberately not logged: your API key, your access tokens beyond a short opaque prefix that identifies a session, and anything the calls returned. The log is a record of intent, not a copy of your data. It is held in Microsoft Azure Log Analytics in West Europe and retained for 30 days.

Who else is involved

• Microsoft Azure hosts this server and holds the logs.
• The assistant you connected. Anything the connector returns is sent to it, and is handled under that provider's own terms — Anthropic's for Claude, OpenAI's for ChatGPT or Codex. We have no control over what it does with the results.

Your data is not sold, not shared with anyone else, and not used to train any model by us.

Ending it

Removing the connector in your client stops it being used. To invalidate the credential itself, revoke that connection's key under API Keys in the PLM: every token carrying it stops working immediately, and your other keys and connections are untouched. A key nobody revokes expires by itself after 365 days, and so does the token that carries it.

Your rights, and getting in touch

The connector reads and writes the same records the PLM already holds about your brand, and the rights you have over those — access, correction, export, deletion — are unchanged and are exercised through the PLM and your existing agreement. For anything about this connector specifically, including a request to purge its logs of your activity, write to support@resourced.com.