This article explains how the Swifteq MCP Server for Zendesk handles your data, how access is secured, and the controls you have. It is written so it can be used in a security review.
In this Article
Data Storage and Retention
AI Models and Training
Hosting and Sub-processors
Certifications and Agreements
Authentication and Request Path
Access Controls
Current Limitations
Data Storage and Retention
- The MCP Server does not store ticket content, conversations, attachments, agent data or customer data. Data is fetched from Zendesk when your AI assistant asks for it, sent to your AI assistant and discarded. Files the AI assistant attaches to a ticket pass through the MCP Server to Zendesk and are not stored either.
- The only information kept is your account email address used for sign-in, minimal infrastructure logs, retained for up to 120 days for troubleshooting, and feedback you choose to send to Swifteq.
- Your AI assistant can send Swifteq feedback about the MCP Server, such as a capability that is missing, but only after you agree in the chat. It is asked to leave out ticket content and personal data. Only plain text is kept, and email addresses are removed. Feedback is stored with your Swifteq account for 12 months and is deleted with the account. To turn it off completely, switch off the submit_mcp_feedback tool in your AI assistant's connector settings.
- Each Swifteq account is fully isolated, with its own database and its own Zendesk credentials.
AI Models and Training
- Swifteq does not run an AI model in the MCP Server and does not send your data to any AI model provider.
- Swifteq does not train models on your data.
- Your AI assistant (for example Anthropic's Claude or OpenAI's ChatGPT) receives the data it asks for. What happens to data once it reaches your AI assistant is governed by your agreement with that provider.
Hosting and Sub-processors
The MCP Server is hosted on AWS in Ireland (EU).
| Sub-processor | Location | What it processes for the MCP Server |
|---|---|---|
| Amazon Web Services | Dublin, EU | Hosting. Zendesk data passes through while a request is processed. |
| Auth0 | United States | Sign-in only: user names, email addresses and IP addresses. No Zendesk data passes through Auth0. |
Auth0 is the only US sub-processor used by the MCP Server. Transfers are covered by the Standard Contractual Clauses, as set out in our Data Processing Agreement. Other sub-processors listed in the Data Processing Agreement are used by other Swifteq apps, not by the MCP Server.
Certifications and Agreements
- Swifteq is SOC 2 Type 2 certified. Documentation is available in our Trust Center.
- Our standard Data Processing Agreement applies to all Swifteq apps. It is part of the Service Agreement you accept when you use the app, so no separate signature is needed.
- To report a security issue, email support@swifteq.com and mark it as a security report.
Authentication and Request Path
- Signing in to the MCP Server uses OAuth 2.0 with the authorization code flow and PKCE. There is no client secret, and no password or implicit grants are used.
- Access tokens are signed, time-limited and issued by Swifteq's sign-in service for Swifteq's apps. Tokens from any other issuer, or issued for any other service, are rejected. Your account is identified only from the verified token, never from request parameters.
- Connecting to Zendesk uses standard Zendesk OAuth with either read, or read and write, access.
- Transport is HTTPS only. Attachments are downloaded only from verified Zendesk URLs.
The request path is: your AI assistant, then mcp.swifteq.com, then the Zendesk API. The MCP Server holds your Zendesk OAuth token and makes the Zendesk API call from Swifteq's infrastructure, then returns the result. agenthelper.swifteq.com is only used for sign-up, Zendesk authorization and settings, and is not in the request path.
If your Zendesk account restricts access by IP address, allow the MCP Server's IP address: 52.215.133.107.
Access Controls
- Your Zendesk permissions apply. The AI assistant can only see what the connected Zendesk user can see, including Private Groups. When team members use their own Zendesk login, their own permissions apply and their changes are shown in Zendesk as made by them. Refer to Inviting Team Members to the MCP Server.
- Read only unless you grant write access. Write access is off by default when Zendesk is authorized. If you grant it, the account owner's settings decide what can change. Internal notes, ticket updates and article drafts are allowed unless the owner turns changes off. Public replies, publishing, changes to users, organizations and macros, and merging tickets stay off until the owner turns them on.
- Central control of changes. The account owner can turn off all changes for everyone, or only public replies, article publishing, changes to users and organizations, changes to macros or merging tickets, and can restrict individual people further, for example to read only. This applies from the next request without anyone reconnecting. Each user can also turn these off for themselves. A restriction can only narrow what the level above allows, never widen it. Refer to Write Permissions for the MCP Server.
- Refusals change nothing. An action that is not allowed is refused, and never carried out in a different form.
- Nothing can be deleted. There are no tools to delete tickets or mark them as spam, or to delete articles or macros. Macros can only be deactivated, and reactivated later. Tags are only added or removed individually, never overwritten.
- One action cannot be undone: merging tickets. Merging closes the duplicate tickets, and Zendesk cannot unmerge them. It is off unless an account owner turns on Allow merging tickets, only tickets from the same requester are merged, and the AI assistant is told to confirm every merge with you first.
- Each tool says what it does. Every tool tells your AI assistant whether it only reads data, only creates something new, or changes something that already exists, so your AI assistant can treat them differently, for example by asking you before a change.
- Removing access. An account owner can turn off a user's MCP access on the Users page. In Zendesk, you can revoke the app's access, or deactivate the Zendesk user who authorized it, and access stops immediately.
Current Limitations
- Zendesk access is either read, or read and write. There is no finer scope, so read access includes attachments and internal notes.
- There is no field-level redaction or PII filtering.
- Individual tools cannot be turned off on the MCP Server. Most AI assistants, including Claude, let you turn individual tools on or off in the connector settings.
- Swifteq accounts do not support SAML SSO, Google SSO or enforced MFA.
- The MCP Server cannot be self-hosted.
If you have more questions for your security review, please contact Swifteq support using the Live Chat or email support@swifteq.com.