Security & privacy
What the RedERP MCP server shares with AI assistants, how permissions and multi-tenancy are enforced, what is logged, and how to disconnect or revoke access.
Principles
- Your login, your permissions. Every tool call is executed as the RedERP user who connected the assistant. Company isolation, role permissions (RBAC), module activation and branch restrictions are enforced by the same API the web app uses.
- Additive writes only. No tool can delete, cancel, void, reject or overwrite existing records. Write tools create clients, documents and lines, move documents forward, convert documents or record payments — all of which stay visible and editable in RedERP.
- Minimal data. Tool responses contain business fields only (names, references, amounts, statuses, business contact details). Passwords, API keys, employee HR data and other companies' data are never returned.
- Explicit consent. The assistant only gains access after you sign in on
https://rederp.ai/oauth/authorizeand click Allow access; the consent page lists exactly what will be shared.
What the assistant provider receives
The data returned by a tool (for example the invoice list you asked for) is sent to the assistant provider (OpenAI for ChatGPT / Codex, Anthropic for Claude, …) and processed under their terms. RedERP does not sell this data or use it for advertising. See the RedERP privacy policy and the provider's policy before connecting.
Tokens
| Item | Value |
|---|---|
| Access token | Opaque, 1 hour, bound to one user + one company + the resource https://rederp.ai/mcp |
| Refresh token | 30 days, rotated on every use; reuse of an old token revokes the whole grant |
| Storage | Only SHA-256 hashes are stored; dynamically registered client secrets are encrypted at rest |
| Transport | HTTPS only; PKCE (S256) is mandatory |
Disconnect / revoke
- From the assistant: ChatGPT → Settings → Apps & Connectors → RedERP → Disconnect; Claude → Settings → Connectors → RedERP → Remove; Codex →
codex mcp logout rederp. The client callshttps://rederp.ai/oauth/revokeand the tokens are invalidated immediately. - From RedERP: company administrators can ask RedERP support to revoke all assistant tokens of a user or of the whole company.
- Lost device: revoking from any other signed-in assistant session, or a password change followed by a support request, cuts access.
Logging & retention
RedERP keeps technical logs of tool calls (timestamp, tool name, company, user, outcome) for security and support, for up to 12 months. Expired authorization codes and tokens are deleted within 7 days. PDF links expire after 7 days; documents created through an assistant are regular RedERP records subject to your company's retention rules.
Recommendations for administrators
- Connect assistants with user accounts that have the right role — the assistant can do exactly what that user can do in Sales.
- Prefer personal accounts over shared logins so actions stay attributable (documents record the creating user).
- Review created documents in Sales → Quotations / Orders / Invoices as you would for any user.
- Keep passwords strong: the consent page applies the same lockout rules as the web sign-in (temporary lock after repeated failures).