> ## Documentation Index
> Fetch the complete documentation index at: https://developer.jobmojito.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data & privacy

> What the JobMojito MCP tools can reach, what is visible before sign-in, where candidate data goes, and how retention and logging work.

Connecting an AI agent to JobMojito means an external model can read your hiring data. This page states exactly what it can reach, and what it can't.

## What requires sign-in

Everything that touches your data. No tool can be called without a verified JobMojito access token, and each call executes **as the signed-in user**, so it respects that user's own permissions and merchant scope.

What is available **without** signing in is capability metadata only:

| Available anonymously                                     | Requires a signed-in token |
| --------------------------------------------------------- | -------------------------- |
| Tool names, descriptions and input schemas (`tools/list`) | Calling any tool           |
| Server capabilities and instructions (`initialize`)       | Reading any resource       |
| A health check at `/healthz`                              | Rendering any prompt       |

This is deliberate. Publishing the tool list lets MCP directories and clients show what the server does before asking you to log in. It exposes the shape of the public [API](/how-the-api-works) — nothing about your account, your candidates or your interviews.

## What a connected agent can see

An agent with a signed-in connection can read whatever the API would return to that user, which for hiring workflows includes personal data:

* **Candidate records** — name, email, and any identifiers you supplied.
* **Interview results** — full transcripts, per-question answers, AI analysis, scores.
* **Interview definitions**, knowledge base documents and merchant analytics.

That content is returned to the MCP client, which means it is processed by **whichever AI provider you connected** — Anthropic, OpenAI, Google, or your own model host — under that provider's terms, not JobMojito's. This is the single most important thing to understand before connecting a production account.

<Warning>
  Connect the account whose data you are willing to send to your chosen AI provider. If you handle candidate data under a DPA that restricts sub-processors, confirm the provider is covered before connecting, and prefer a scoped sub-merchant over a parent account that can see everything.
</Warning>

## Reducing exposure

* **Scope with `merchant_id`.** Connect as a user who can only see the merchants they need — see [Merchant scoping](/mcp/overview#merchant-scoping).
* **Ask for less.** The read-only `list_*` tools return summaries; call `get_interview_result_details` only when a full transcript is genuinely needed.
* **Use a dedicated user.** An MCP-specific JobMojito user with narrow permissions makes the access boundary explicit and revocable.
* **Revoke cleanly.** Removing the connector in your AI client ends its access; revoking the user in JobMojito ends it everywhere.

## Retention and data-subject rights

Using MCP changes nothing here — the tools call the same API as any other integration. Candidate interview data is retained for **12 months by default** and is configurable by the customer; access and security logs are retained for 12 months. Defaults, sub-processors and the international-transfer position are in the [Privacy Policy](https://jobmojito.com/privacy_policy) and at [trust.jobmojito.com](https://trust.jobmojito.com).

Your AI provider's retention of the conversation itself is separate and governed by them.

## What JobMojito logs about MCP use

The server logs the **name of each tool called, its argument keys, and the outcome and duration** — for diagnostics and abuse prevention. It does not log argument values, tool results, or any conversation content.

## Security

* HTTPS only, over MCP Streamable HTTP.
* OAuth 2.1 with PKCE. Tokens are never accepted in a URL.
* The server is an OAuth resource server and validates each token's signature, issuer, expiry and audience against the resource it advertises at `/.well-known/oauth-protected-resource/mcp`.
* Report a suspected vulnerability to [**security@jobmojito.com**](mailto:security@jobmojito.com).

## Related

* [Responsible use](/mcp/responsible-use) — human review and candidate disclosure.
* [Authentication](/authentication) — how tokens map to environments and permissions.