Overview

A clear view of how Mad Fish Elements protects data, governs access, and operates the services behind every Element.

One governed path to every connected system

Mad Fish Elements separates the portal control plane from the MCP request path. The portal manages organizations, users, connections, credentials, permissions, API keys, and OAuth grants. The MCP gateway receives only the identity and capability state required to authorize a request.

Provider credentials are written to Azure Key Vault. LLM clients receive a scoped API key or OAuth access token, never the credential for Google, Microsoft, Workamajig, Shopify, or another connected service.

Identity

Every key and OAuth token resolves to one organization and one portal user.

Policy

Connection visibility and Read, Write, and Delete grants are evaluated per user.

Traceability

Credential changes, key rotation, authorization, and synchronization are auditable.

How the platform is organized

Security controls follow the request from configuration through execution.

Portal control plane

Administrators choose available connections, assign user access, configure capabilities, and issue or revoke credentials.

Encrypted credential store

Raw provider secrets are stored in Azure Key Vault. Portal records retain secret names, versions, status, and non-secret configuration.

MCP authorization layer

The gateway hashes the presented bearer or API key, resolves its organization and user, and applies that user's enabled platform and capability map.

Customer-directed providers

Only an enabled tool can call a connected provider, and provider responses return through the same governed request path.

Review the controls in detail

Continue through security, data handling, sub-processors, and the API contract from this Trust Center.

Security controls