Security and data
Searchata separates search-provider authorization from agent authorization. Each agent connection belongs to one user and workspace.
Data flow
- The user authorizes a source.Google or Microsoft gives Searchata read-only access to the selected search data.
- The user authorizes an agent.Searchata issues a separate MCP credential for that user and workspace.
- The agent calls a tool.Searchata validates the MCP credential and requests the selected data from the correct source.
- Searchata returns the result.The tool returns only the source data needed for that request.
Permissions
A Searchata agent connection includes current and future Searchata tools. Existing OAuth connections and API keys receive access to new tools without reconnecting. Your plan, connected sites, and usage limits still apply. Site crawls use account credits.
Searchata does not request write access from either source. The MCP tools cannot add users, change site settings, submit or delete sitemaps, or request indexing.
Stored data
Searchata stores account details, Clarity reconciliation metadata, workspace records, connected property metadata, encrypted Google and Bing OAuth credentials, MCP authorization records, public plan and usage records, and short-lived encrypted source-response caches.
Searchata does not collect Claude conversations, agent memory, uploaded files, or prompts beyond the parameters that an agent sends to a selected Searchata tool.
OAuth
The remote MCP endpoint supports OAuth 2.0 authorization code flow with PKCE, dynamic client registration, access-token expiry, refresh tokens, and protected-resource discovery.
- MCP endpoint
https://searchata.com/mcp- Protected resource
https://searchata.com/.well-known/oauth-protected-resource/mcp- Authorization server
https://searchata.com/.well-known/oauth-authorization-server
Revocation
A user can disconnect one agent in the agent connector settings. A user can also disconnect Google Search Console or Bing Webmaster Tools on the Sources page. This stops all Searchata tool access to that source connection.
For account-data deletion, contact privacy@searchata.com.
Security reporting
Send vulnerability reports to security@searchata.com. Do not include live credentials, source tokens, or search-data exports.