Security & Data

Infrastructure

MetraClick MCP runs on a dedicated server hosted in a data center in the United States. The server is not shared with other applications, and access is restricted to authorised KohlerCode personnel.

How we store your credentials

When you connect a service (for example YouTube, X, or your own API key), you hand MetraClick the credentials that service requires. We treat these as secrets:

• Encrypted at rest. Credentials are stored encrypted on the server. We do not keep plaintext copies.
• Transmitted securely. All traffic between your AI client and MetraClick is sent over TLS (HTTPS).
• Never exposed. Secrets never appear in tool arguments, API responses, or logs. They are resolved server-side, per workspace, only when a tool needs them.
• Shown once. A secret is never displayed again after you save it; you can replace it without reading back the old value.
• Scoped per workspace. Credentials belong to one workspace and are never shared with another.

We deliberately do not publish the specific encryption methods we use; they are reviewed and rotated as part of normal operations.

Your responsibility

Keep your API key and workspace name secret. You are responsible for activity carried out with them. If you believe a credential has been compromised, rotate it immediately in the MetraClick app.