Skip to content

Privacy for operators

pivotkit's MCP server and REST service compute reports over data you configure and hand the results to callers you sign in. Neither decides what is lawful or appropriate for your data; that is yours. This page lists what to decide and which setting carries it. It makes no compliance claim.

Purpose per source and caller

Write down, per source, why it is served and to whom: an analyst's dashboard, a nightly export, an AI assistant for a team. Then give each kind of caller its own token (or OAuth client or scope) and, where it needs more than the default, its own profile. A source only some callers may use gets scopes; a source no caller needs is not configured at all.

Start from little

The defaults show little: every field is summary (name, type and counts, no values), inline results are off for REST, downloads need results: true, files by path are off. Open up field by field (show) for what a purpose needs, and hide what no caller needs: a hidden column is dropped when the data is read. Leaving a column out of the data file is safer still.

What counts as personal data

  • Values of a field about people (names, e-mail addresses, IDs) are personal data; so can be dates and free text.
  • Field names are data too: every caller sees the names of the fields it may use, at every level.
  • Aggregates can be personal data: a sum over a group of one is that person's value, and a count can answer "is this person in the data?". The policy withholds a result's shape when a view uses a field that is not shown, but every number in a report is real. Filter out or merge small groups in the data itself when that matters; pivotkit does not suppress small cells.
  • Links and drafts carry a view (field names, filter items) to whoever opens them. The report page a link opens, and a scheduled report once a person approves the draft, are not limited by this policy: whoever may open them sees the values. Keep those pages behind your own sign-in.
  • Downloads: a caller whose policy has results: true may read every value of every field that is not hidden, in a file, whatever level the field has.
  • Names match without regard to case, Unicode form or the kind of whitespace (a no-break space or doubled spaces in a header match one space in the policy; two rules for the same field keep the stricter level); a column the reader renamed because its header repeats a hidden one ("Email (2)") is hidden too. Other columns the reader names itself ("Column 8" for cells without a header) take the default level: for a source of personal data, start from "default": "hide" and list the fields to show.

Recipients

Whoever holds a token, or signs in with OAuth, receives what its policy allows, and the reports written for it are in the output directory. Treat token holders as recipients of that data: give tokens to people and systems, not to groups that change, rotate them (token files are read on every request), and keep OAuth access tokens short-lived, since a token stays valid until it expires.

Logs and retention

The log holds the operation, the source id, the client (a token's name or an OAuth client id, never a person's id), the status and the time (a source id only when it is a configured source); at the default level never a view, a value or a token, and no client address unless http.trustProxy is set. Reports and drafts stay in the output directory until you remove them: output.maxAgeDays deletes older reports and drafts (drafts waiting for approval too) at start and every hour, or clean it up on a schedule of your own; give the output directory to pivotkit alone. Reports are written with mode 0644 (less the umask), readable for other local users: restrict the directory itself where that matters. Decide how long the log and the reports are kept, and who can read the output directory (a web server that serves it, output.baseUrl, makes every file reachable by its name).

The AI client

An MCP client sends what the model sees (descriptions, findings, inline results) to the model's provider. What the policy shows a model is what that provider receives. See Security: the MCP server.