Privacy and Security

Optimly MCP applies authentication, brand selection, permissions, and approval checks before returning private data or executing a Business Profile mutation.

Runtime and data paths

Optimly MCP runs on Cloudflare Workers and does not connect directly to Optimly's databases. Brand reads and writes flow through purpose-built HTTP APIs. Some tools also call external crawl, ranking, or AI services needed to complete the requested analysis.

Credentials

MCP access requires OAuth or an osk_ brand API key. Brand-key resolution may be cached in Worker memory for five minutes. OAuth access tokens are introspected against the Optimly app. Never include credentials in prompts, URLs, browser code, screenshots, or source control.

Brand isolation

Brand-scoped API keys resolve to one brand. OAuth sessions carry an explicit authorized-brand set and per-brand permissions. Multi-brand sessions must select an authorized brand before private Business Profile, audit, source, or action tools run.

Private and public brand data

Core tools can read public Brand Trust Registry data. Partner Program and Enterprise tools can additionally read private, authorized Business Profile and audit data. Public-registry comparisons do not grant access to another brand's private Business Profile or audit results.

Controlled Business Profile writes

Approval-bound write access does not permit an agent to make arbitrary changes. A mutation must match one exact, approved action payload.

1
Propose

Create an immutable action and hash its sanitized payload.
2
Approve

Bind a time-limited approval to the exact action.
3
Execute

Call brand_update with action, approval, actor, and idempotency key.
4
Audit

Record the version, previous/current value, actor, and execution event.

Operational logging and retention

Optimly MCP and its upstream services may record security, authorization, action, feedback, and operational events needed to provide and protect the service. Retention depends on the event type and applicable Optimly policy. Avoid sending secrets or unrelated personal information in tool arguments.

Tool results may include third-party source URLs, crawl output, or model responses. Review those results before publishing or acting on them, particularly when a tool labels evidence as inferred, incomplete, or preview.

Security questions

Contact [email protected]. Include the affected brand and client, but do not email API keys, access tokens, or full authorization headers.

Last reviewed: July 27, 2026.