Legal
Last updated: July 2026. This policy explains what data Zephex collects, why, how long it is kept, and what controls you have.
Account data lives in Supabase Postgres (API key hashes, usage logs, billing links, profile fields). Dashboard sign-in uses Supabase Auth (email/password, GitHub/Google OAuth, magic links, passkeys). MCP tool calls authenticate with Bearer API keys validated against hashed keys in the same database. MCP connector OAuth (Claude.ai, ChatGPT, and similar clients) uses Auth0 as the authorization server with PKCE. Plaintext API keys are never stored after creation.
Live health for database and authentication is published at zephex.dev/status. See also Authentication & Account Security.
| Provider | Role |
|---|---|
| Supabase | Postgres database and dashboard authentication (accounts, API key hashes, usage logs, sessions). |
| Auth0 | OAuth authorization server for MCP connector clients (Claude.ai, ChatGPT, PKCE flows). |
| Railway | MCP Server — hosts tool execution (find_code, read_code, check_test, etc.). |
| Vercel | Dashboard, public MCP endpoint proxy (zephex.dev/mcp), and edge routing. |
| Upstash Redis | Rate limiting, session cache, and health-check coordination. |
| Stripe | Payments, subscriptions, and billing meters. |
| Resend | Transactional email (verification, security alerts, billing notices). |
| Sentry | Error monitoring with PII redaction. |
| PostHog | Product analytics (optional; EU users can decline via cookie banner). |
Zephex is a cloud-hosted MCP (Model Context Protocol) proxy service. Users connect their AI code editors to our endpoint and access developer tools through a single API key. The service is operated as a sole proprietorship.
| Category | Data | Source |
|---|---|---|
| Account | Email address, OAuth provider ID, display name | Signup / OAuth |
| Authentication | Hashed password, MFA secret (encrypted), session tokens | Login |
| API Keys | HMAC-SHA256 hash with per-key salt, key prefix, creation date, last-used timestamp | Key creation |
| Usage | Tool name, timestamp, response status, latency per request | Each API call |
| Billing | Stripe customer ID, subscription status, payment method last 4 digits | Stripe |
| Device | Hashed IP address, User-Agent, MCP client name/version | Each request |
| Analytics | Page views, feature usage events (anonymized) | Dashboard interaction |
| Data type | Retention period | On account deletion |
|---|---|---|
| Account profile | Until account deleted | Removed within 30 days |
| API key hashes | Until revoked or account deleted | Removed immediately |
| Usage events (tool name, timestamp) | 90 days rolling | Removed within 30 days |
| Hashed IP / User-Agent | 90 days | Removed within 30 days |
| Tool input/output content | Not stored — processed in memory only | N/A |
| Billing records (Stripe) | As required by tax law (typically 7 years) | Anonymized |
| Audit logs | 1 year | Removed within 30 days |
| Email queue records | 30 days after send | Removed immediately |
Zephex uses the providers listed under Database & Authentication, plus transactional email and error monitoring. All processors are bound by data processing agreements. No processor receives plaintext API keys. Tool call content passes through infrastructure in memory and is never written to disk or logs.
If you roll Zephex out to a team, the account owner remains responsible for every API key created under that account. Each developer should use named keys per environment; shared keys in chat or public repos violate our acceptable-use rules.
Usage metadata is stored per API key (tool name, timestamp, status, latency) so account owners can monitor quota. Tool arguments and outputs are not stored. Rollout policy: Team MCP rollout.
Zephex does not use prompts, tool inputs, tool outputs, or repository content accessed through tools to train, fine-tune, or evaluate AI models. This applies to all plans without exception.
Zephex is a proxy; it routes requests to tools and returns results. It does not fine-tune, distill, or otherwise learn from your data.
| Data | Stored? | Duration |
|---|---|---|
| Source code in tool calls | No | — |
| Tool input arguments | No | — |
| Tool output / response body | No | — |
| AI chat / prompts | No | — |
| Tool name per call | Yes | 90 days |
| Timestamp + success/error + latency | Yes | 90 days |
| API key hash (HMAC-SHA256 + salt) | Yes | Until revoked |
| Hashed IP address | Yes | 90 days |
Regardless of your location, you can:
To exercise any right, use Dashboard → Settings or email support@zephex.dev. We respond within 30 days.
In the event of a data breach that affects your personal information, we will notify you without undue delay and as required by applicable law (method and timing depend on jurisdiction and severity).
Zephex is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, contact support@zephex.dev and we will delete it promptly.
Material changes are announced via email to registered users at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent revision.
Privacy questions: support@zephex.dev