Security and data

Data flow

1. The user authorizes a source.Google or Microsoft gives Searchata read-only access to the selected search data.
2. The user authorizes an agent.Searchata issues a separate MCP credential for that user and workspace.
3. The agent calls a tool.Searchata validates the MCP credential and requests the selected data from the correct source.
4. Searchata returns the result.The tool returns only the source data needed for that request.

Permissions

Searchata does not request write access from either source. The MCP tools cannot add users, change site settings, submit or delete sitemaps, or request indexing.

Stored data

Searchata stores account details, Clarity reconciliation metadata, workspace records, connected property metadata, encrypted Google and Bing OAuth credentials, MCP authorization records, public plan and usage records, and short-lived encrypted source-response caches.

Searchata does not collect Claude conversations, agent memory, uploaded files, or prompts beyond the parameters that an agent sends to a selected Searchata tool.

OAuth

The remote MCP endpoint supports OAuth 2.0 authorization code flow with PKCE, dynamic client registration, access-token expiry, refresh tokens, and protected-resource discovery.

MCP endpoint

https://searchata.com/mcp

Protected resource

https://searchata.com/.well-known/oauth-protected-resource/mcp

Authorization server

https://searchata.com/.well-known/oauth-authorization-server

Revocation

A user can disconnect one agent in the agent connector settings. A user can also disconnect Google Search Console or Bing Webmaster Tools on the Sources page. This stops all Searchata tool access to that source connection.

For account-data deletion, contact privacy@searchata.com.

Security reporting

Send vulnerability reports to security@searchata.com. Do not include live credentials, source tokens, or search-data exports.

Read the security-reporting guidance