Security
Two security teams read this: the one at the company shipping the product, and the one at the enterprise installing it. Everything below is a mechanism rather than a policy, so both can verify it instead of believing it.
The questions before the green light.
Only approved capabilities
Scoped to one environment
Recorded against the reviewed version
Observed and asserted claims kept apart
Security and enterprise readiness
These are not policies. They are boundaries enforced in code, each one covered by the test suite.
Rows hold a Secret Manager name, and the name embeds the customer environment id. That is what structurally prevents two customers ever sharing a credential.
credential_referencesenv--a91f…--access_tokenxoxb-••••••••••••Credential-shaped keys are redacted from every event, audit entry and log line before they are written.
The hosted MCP endpoint resolves a bearer token to exactly one customer environment, and rejects a token issued for a different product.
Every call is checked against the capability's own schema before anything reaches your backend. Execution is audited by argument name, never by value.
Authorizations, approvals, credential rotations, state changes and executions are all recorded.
Models may suggest descriptions and mappings. Permissions, scopes, schemas and validation rules come from deterministic code.
Data flow
Four steps, in this order. The order is the security property: validation happens before the network hop, not after it.
The customer's client posts a tools/call to the hosted MCP endpoint with a bearer token issued for one customer environment. The token is the only thing that decides whose deployment this is.
The payload is checked against the capability's own JSON Schema. A call that fails is refused here. Nothing is forwarded, and the vendor backend never sees it.
A capability that deletes data waits for approval every time, and a write waits when the customer's policy says so. Nothing is forwarded. The request appears in the conversation that asked and on the customer's portal, and it runs exactly once, after somebody allowed to approve it does.
The credential is fetched from Secret Manager under a name that embeds this customer environment id. It is not cached across customers and never written to the database.
Before a result leaves, the customer's masking policy replaces the personal data it names, so no client or model reads it. Results transit Meetext in memory on their way back to the destination and are not stored. What is written down is which capability ran, for which environment, with which argument names, whether it succeeded, and how many values of each kind were masked.
Data handling
Capability results pass through the hosted MCP endpoint to reach the destination, so they transit Meetext in memory. They are not written down.
Review questions
No path exists to try. Tools come from the calling environment's frozen package and credentials are resolved by a name containing that environment's id. A bearer token issued for a different product is rejected without revealing whether that product exists, and cross tenant reads return 404 rather than 403.
No. Models draft descriptions and suggest mappings. Risk levels, scopes, schemas and validation rules come from deterministic code, and every write or destructive capability requires an explicit human approval recorded against a named actor.
Not a deletion, ever. A capability that deletes or irreversibly changes data waits for approval every time, and in chat the person who asked for it cannot be the one who approves it. Anyone holding your installation link can also decide on the portal, and that decision is recorded as the link holder's. A write waits too when your policy says so, which is the default for new installations. The Meetext Agent can only propose changes; a person confirms each one, and the check sits in the tools rather than in anything a model reads.
Only the contact on your record, with your vendor's teammates copied if they choose, and only after a person at your vendor has read and confirmed the draft, or set up a scheduled check that is allowed to. The agent cannot pick any other address. If you reply and replies are set up, the answer it drafts uses only your own installation's information, and a person confirms it unless your vendor allowed automatic replies for that conversation.
No. Credentials never pass through it: they go from the page straight to secret storage, and it refuses a request that includes one. A link that carries a token, such as your installation link or a shared security review, is shown to the person who asked for it and never to the model.
Only what your masking policy leaves. Email addresses, phone numbers, US social security numbers, payment cards, IBANs and IP addresses can be masked in every result before any client or model reads it, and new installations mask social security numbers, cards and IBANs by default. With tokens turned on, the AI can act on a masked value without seeing it: Meetext puts the value back just before the call runs.
The next validation observes the revocation, the deployment moves to disconnected, and the endpoint stops executing. Revocation is treated as an answer, not a fault: nothing done server side re-establishes it, and the customer gets a reconnection link if they want one.
Yes. Your vendor can share a security review for your specific environment. It lists every capability, its risk level and what it can reach, and each statement shows whether Meetext observed it, inferred it, or the vendor asserted it.
Posture, stated plainly
The boundaries on this page are enforced in code and covered by tests, which is a different claim from a completed audit. A SOC 2 report is not something we can hand you today. A data processing agreement is available on Enterprise, and a security review of a specific customer environment is available on every plan, including the free one.
If your procurement process needs something we do not have yet, tell us what and by when. We would rather be told the requirement than be measured against it after the fact.
Connect a source, approve what ships and send your customer an install link. 2 customer environments free. No card required.