Technical Reference
Platform security
Terminology
In this document, “Customer” refers to the user of the platform. “End User” refers to a user of an MCP server hosted by the platform on behalf of the Customer.
The AI Control Plane is designed as a high-performance, security-first, serverless tools platform. It routes requests from a hosted MCP server (often hosted at mcp.your-company.com) to production APIs, following all modern security practices for web application development and data storage.
Certifications
Section titled “Certifications”The platform maintains the following security certifications and compliance standards:
- SOC 2 Type II - Independently audited controls for security, availability, and confidentiality
- ISO 27001 - International standard for information security management
- GDPR compliant - Data processing agreements available with privacy by design
- CCPA compliant - User data deletion on request
Industry affiliations
Section titled “Industry affiliations”Speakeasy is affiliated with The Linux Foundation, the Cloud Security Alliance, and the Agentic AI Foundation.
Architecture overview
Section titled “Architecture overview”The platform is hosted on Speakeasy servers provisioned in Google Cloud Platform and consists of two main components:
Control plane
Section titled “Control plane”The control plane includes:
- Dashboard - Web interface for managing toolsets and configurations
- Metadata database - Storage for toolset metadata
- Authentication service - Customer authentication provided through WorkOS
Data plane
Section titled “Data plane”The data plane consists of a request proxy that:
- Processes requests from MCP endpoints
- Forwards requests to APIs according to the grouping of endpoints in a toolset
- Processes requests to LLM inference providers, routed through OpenRouter, when using the in-app playground feature
Authentication
Section titled “Authentication”Authentication in the platform is shared with the Speakeasy platform. Access is granted through Organizations with login support available through Google and GitHub identity providers. Unauthenticated sessions are not supported.
SSO support is available on request to enterprise customers.
Encryption
Section titled “Encryption”All data processed by the platform is encrypted in transit. HTTPS is the standard protocol for all MCP servers hosted by the platform.
For Customers using platform-managed authentication, Customer keys and secrets are encrypted using symmetric key encryption (AES-GCM) in the database, in addition to the encryption defaults provided by Google Cloud SQL. OAuth access and refresh tokens obtained through managed OAuth flows are encrypted before storage in the same way.
Business continuity and disaster recovery
Section titled “Business continuity and disaster recovery”If the platform experiences downtime, there is no impact to the Customer’s API uptime. MCP servers hosted by the platform will become unavailable, meaning requests from MCP clients to those specific servers will not be processed.
Metadata on Customer toolsets is stored in Google Cloud SQL with:
- Multi-region replication
- Failover redundancy
- Encrypted connections
Data storage FAQ
Section titled “Data storage FAQ”Does the platform store API or customer data?
Section titled “Does the platform store API or customer data?”The platform does not store Customer data. It only processes data in transit.
Can the platform store API secrets?
Section titled “Can the platform store API secrets?”By default, the platform does not store API secrets.
Customers have the option to store API secrets if they choose to use platform-managed authentication and API keys. When an MCP server uses a managed OAuth flow, End User access and refresh tokens are encrypted before being stored so the platform can complete the flow on the End User’s behalf.
What data does the platform store?
Section titled “What data does the platform store?”The platform only stores metadata. Customer data is only processed in transit.
Stored data on the platform’s servers includes:
- Email addresses used to log in to the platform
- Metadata on created tools, specifically:
- Date and time of tool creation
- Corresponding API endpoint
- Specification version
- Error details for any errors that occurred during creation
- Metadata on tool calls, specifically:
- Tool used
- Time
- Request origin
- Request shape
- Request success or failure
- Point-in-time snapshots of API specifications for comparing changes
Tool call telemetry is retained for 90 days.