Privacy Addendum: Validity Engage MCP Server
Effective date: October 1, 2026
1. What this Addendum covers
This Addendum supplements the Validity Privacy Policy at https://www.validity.com/privacy-policy/ (the “Privacy Policy”) and describes how Validity, Inc. and its Affiliates (“Validity,” “we,” “our,” “us”) process information when you connect an AI assistant (your “AI Client”) to Validity Engage through our Model Context Protocol (MCP) Server, (the “Server”). It is additional to, not a replacement for, the Privacy Policy, which continues to govern your underlying Validity Engage account data. The Validity Data Processing Addendum and your service agreement continue to apply where Validity processes personal data on behalf of your organization. If there is a conflict between this Addendum and the Privacy Policy with respect to the Server, this Addendum controls. For Engage user terms, please refer to https://www.validity.com/legal/engage/.
2. How the Server works
The Server lets an AI client you authorize query your Validity Engage services conversationally. When you ask a question in your AI client, it sends a request to the Server; the Server checks the request, retrieves only the data needed to answer — filtered to what your account is permitted to access — and returns a response. Data is retrieved on demand per request; the Server does not give the assistant bulk access to, or a background index of, your account. No tool runs without your explicit OAuth consent, and you can revoke access at any time.
Records are fetched from Validity Engage services, filtered to what your account is permitted to access, and returned to your AI client. The source data is governed by the Privacy Policy.
3. Information we collect through the Server
In addition to the categories in Section III of the Privacy Policy, the Server processes the following:
| Category | What it includes | Retention |
|---|---|---|
| Authentication and identity data | The Server does not store your OAuth grant. Each request presents the access token issued by our authorization server (Litmus). The Server verifies that token with Litmus on every call and holds the verification result in memory only, for no more than 60 seconds. The grant itself, including the token, the scopes you approved, and the link between your Litmus account and Validity account, is held by Litmus and restated to the Server on each verification. | Grant: until revoked or expired. Account link: per Validity’s retention policies. |
| Requests made on your behalf | The tool name and arguments your AI client sends when you ask a question (which may echo parts of your prompt) and the results of guardrail checks applied to inputs and outputs. | Operational logs, which may include request and response content, are retained per Validity’s retention policies. |
| Conversation memory | The content of your exchanges with the Server, retained between sessions so the assistant can maintain context, and an adaptive profile summarizing your recurring topics and configuration to improve responses over time. | Per Validity’s retention policies. |
| Files you attach | Images or documents you submit through your AI client for the Server to analyze. | Per Validity’s retention policies. |
| Usage records | A per-invocation entry in our usage records (which agent ran, when, for which account) used for metering and billing. | Retained for billing and audit purposes per Validity’s retention policies. |
We do not sell your Personal Data, and we do not use data processed through the Server for advertising.
4. How we use this information
We use Server data to (a) authenticate and resolve your permissions, (b) answer user questions, (c) maintain conversational context between sessions, (d) apply safety guardrails that validate inputs and keep outputs within your account’s scope, (e) meter usage for billing, (f) secure, troubleshoot, and improve the service, and (g) comply with applicable law.
Purpose limitation. The account link described in Section 3 is used to resolve your permissions when you use the Server. This link is the same coordination used for Validity’s current Services (such as Litmus and Engage).
5. Authentication and security
The Server uses OAuth 2.1 with PKCE and dynamic client registration. You authenticate directly with Validity’s authorization service; your password is never shared with your AI client or with any AI model provider. Your AI client holds an opaque, audience-bound access token, which the Server verifies with our authorization server, re-checking at least every 60 seconds, to confirm it is active and carries the required scopes. Requests are protected in transit with TLS. Inputs are checked for prompt injection and outputs are checked for scope before they are returned. For more information, please refer to the security measures described in Section VIII of the Privacy Policy which apply to the Server.
What you are told at authorization. When you connect, you are shown a consent screen operated by Litmus, Validity’s authorization service, which identifies the Server requesting access and the permission it is asking for. Your approval is what authorizes the Server. If you do not approve, no access token is issued; the Server is not authorized to reach any Validity data, and no connection is established.
Logging. The Server generates operational and audit logs that may include the content of requests and responses, such as the text of questions routed to the Server and the data returned. Logs are stored in our logging platform and retained per Validity’s retention policies.
6. Third parties
Your AI client. When the Server returns data to answer your question, that data becomes part of your conversation in your AI client and is thereafter handled under that client’s own privacy terms — see Section 7. Please refer to our AI Providers Terms and Conditions at Section 3 of our Engage Terms of Service.
Hosting and infrastructure providers. The Server runs on Validity-operated infrastructure hosted by Amazon Web Services in the United States, where Server data is stored and processed. Infrastructure providers process data in transit and retain short-lived operational logs under their own terms.
We do not share Server data with any other third party except as described in the Privacy Policy (for example, service providers under contract, or where required by law).
7. What happens to data inside your AI client
Once the Server returns data to your AI client, that data is processed on the client provider’s systems and becomes part of your conversation history there. How that provider stores and retains it — and whether it may be used for model training — depends on your agreement and plan with that provider, not on Validity. Validity is not responsible for the AI client’s handling of data after delivery. For the avoidance of doubt, you are responsible for the data handling of your chosen AI client, Validity assumes no responsibility or liability for your user agreement with the AI client.
8. Data retention and deletion
Server data is retained in accordance with Validity’s retention policies. When you revoke the Server’s access or your account is deprovisioned, the assistant can no longer retrieve data on your behalf within one minute.
9. Your rights and choices
Revoke access at any time. Remove the Server in your AI client or revoke the grant from your Validity account. Revocation takes effect for new requests immediately.
Exercise privacy rights. You may exercise the rights described in Sections XVI–XVII of the Privacy Policy — including access, correction, deletion, and objection — through the request forms linked there or by contacting privacy@validity.com. If you are an end user of a Validity customer, we may direct your request to that organization as required by law. Deletion requests covering the Server are handled through Validity’s established data-subject-request process. You may also raise a request through Validity support.
10. International transfers
Server data may be stored and processed in the United States and other countries where Validity or its service providers operate. Validity adheres to the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF, and uses appropriate safeguards, including Standard Contractual Clauses where required, as described in Sections 14–15 of the Privacy Policy.
11. Changes to this Addendum
We may update this Addendum as the Server evolves. Material changes will be reflected in the effective date above.
12. Security incident notification
In the event of a security breach affecting the Server, Validity will follow its notification process listed within the Data Processing Addendum, found at https://www.validity.com/legal/data-processing-addendum/.
13. Contact
Validity, Inc., Attn: Privacy Department, 100 Summer Street, Suite 2900, Boston, MA 02110, United States · privacy@validity.com · For security concerns relating to the Server, contact security@validity.com.