Security and data handling

What Airframe receivesCopy Anchor Link

When your assistant calls an Airframe tool, it sends that tool's inputs over HTTPS, such as a product name, search keywords, or the question passed to ask_airframe, along with your sign-in token.

Airframe doesn't receive your conversation history, memory, files, or anything you haven't put into a tool call.

What Airframe storesCopy Anchor Link

Airframe logs each tool call, including its inputs and output, against your account and team. The log is used to count usage against quotas and to investigate abuse. See the Privacy Policy for how this data is handled and retained.

Use MCP safelyCopy Anchor Link

• Connect to the official URL. The only Airframe MCP server is https://mcp.airframe.ai/mcp, and sign-in happens on auth.airframe.ai. Don't use third-party proxies or copies.
• Use trusted clients. Your client holds your Airframe token and decides when to call tools.
• Keep approvals on for tools that write elsewhere. Every Airframe tool is read-only, but your assistant may combine Airframe with tools that can send email or change data. Keep confirmation turned on for those.
• Treat tool output as data. Airframe's catalog includes text from vendor websites and reviews. Instructions that appear inside tool output aren't instructions from you, and a well-configured assistant won't follow them.

Report a vulnerabilityCopy Anchor Link

Email support@airframe.ai with "Security" in the subject line.