Core documentation content is fully readable without JavaScript. The table of contents, assistant, and some copy buttons enhance the experience but are not required.

Legal

Security & Privacy

Last updated: July 2026. Zephex is a hosted MCP server. This page explains how API keys are protected, what request data we see, how long it is kept, and the controls in place to prevent abuse.

DATABASE & AUTHENTICATION

Supabase Postgres — accounts, API key hashes (HMAC-SHA256 + per-key salt), usage logs, billing links. Row-level security isolates customer data.
Supabase Auth — dashboard login (email/password, OAuth, magic links). MFA secrets encrypted with AES-256-GCM.
MCP tool calls — Bearer API keys only; validated per request against hashed keys in Supabase.
Operational status: zephex.dev/status · Deep dive: Authentication docs.

AUTHENTICATION

Every request requires a valid API key sent as a Bearer token in the Authorization header.
API keys are hashed before storage. Plaintext keys are never retained after generation.
Keys can be created, rotated, and revoked from the dashboard at any time.
Each key is scoped to a single account and inherits that account's plan limits.
Keys expire after 365 days by default; users can configure shorter lifetimes.
Failed authentication attempts are logged and rate-limited per IP.

WHAT ZEPHEX SEES

When you call a Zephex MCP tool, Zephex receives:

Your API key as a Bearer token, used only for authentication and discarded from memory after validation.
The name of the tool you called (one of the 10 supported tools).
The arguments you passed (such as a file path, search pattern, or URL).
Request metadata such as timestamp, hashed IP address, and User-Agent for rate limiting and abuse prevention.
The MCP client name and version from the initialize handshake (e.g., "cursor 0.50.1").

Zephex does not receive:

Your AI model prompt or full chat history.
The full contents of your repository (only the specific files referenced in tool arguments).
Your editor's surrounding conversation context.
Any data from tools you did not explicitly call.

Tool outputs pass through Zephex infrastructure before returning to your editor. Content is processed in memory and is not persistently stored.

DATA RETENTION

Data type	Retention	Purpose
API key hash	Until revoked or account deleted	Authentication
Tool name + timestamp per call	90 days	Usage tracking, billing, rate limiting
Hashed IP, editor name	90 days	Abuse detection, analytics
Tool input/output content	Not stored	Processed in memory, returned to client, discarded
Account data after deletion	Removed within 30 days	Privacy compliance

MODEL TRAINING

Zephex does not use any user data — prompts, tool inputs, tool outputs, or code accessed through the tools — to train AI models. This applies across all tiers (Free, Pro, Max).

TRANSPORT

All traffic uses HTTPS with TLS 1.3.
The MCP endpoint enforces HSTS with a 1-year max-age.
Security headers include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
Session cookies use HttpOnly, Secure, and SameSite=Strict flags where applicable.
You can validate transport posture against any URL using the audit_headers tool.

TEAM GOVERNANCE

If you roll Zephex out to a team, the account owner remains responsible for every API key created under that account. Each developer should use named keys per environment; shared keys in chat or public repos violate our acceptable-use rules.

Full rollout policy: Team MCP rollout — covers all 10 tools, plan quotas, and security review links.

Key policy	Detail
One key per person per environment	Example: cursor-dev-alice, ci-staging, prod-api-01. Never post keys in Slack, email, or public repos.
Rotate on offboarding	When a contractor or employee leaves, revoke every key they had access to in the dashboard — do not rotate the whole team unless compromised.
CI uses dedicated keys	Separate keys for automation; prefer Pro/Max tool scopes so CI cannot call tools it does not need.
Store secrets in a vault	Local .env for dev; Doppler, AWS Secrets Manager, or your CI secret store for staging/prod — never commit keys.
Name keys for analytics	Readable names make dashboard usage attribution obvious when debugging quota or abuse.

If a key is exposed:

Revoke exposed key immediately in dashboard → API Keys
Create a replacement key; update vault/CI — never reuse the leaked secret
Run mcpcli doctor or /doctor to verify editor configs still reach MCP
If editor JSON was committed: mcpcli repair or /repair for stale npx pins
Email support@zephex.dev if you suspect account-wide compromise

ACCESS CONTROLS

Dashboard authentication uses email/password with optional TOTP-based MFA.
API keys support optional IP allowlists and tool-scope restrictions on Pro and Max plans.
OAuth 2.1 with PKCE is supported for CLI-based authentication flows.
Account lockout activates after consecutive failed login attempts.
Disposable email domains are blocked at signup.

ABUSE PREVENTION

Per-user rate limiting using a token-bucket algorithm prevents burst abuse.
Per-IP rate limiting prevents credential-stuffing attacks regardless of key count.
Anomaly detection flags unusual request patterns and geographic impossibilities.
Audit logging captures authentication events and operational changes.

YOUR DATA RIGHTS

You can request the following at any time:

Access — an export of all stored personal data.
Rectification — correction of inaccurate data.
Erasure — deletion of your account and all associated data.
Portability — a machine-readable export of your data.

Submit a request from Dashboard → Settings → Privacy, or email support@zephex.dev.

VULNERABILITY REPORTING

To report a security vulnerability, email support@zephex.dev with:

Steps to reproduce
Expected vs. actual behavior
Impact assessment if known

Please do not publicly disclose until we acknowledge and address the report. We aim to respond within 48 hours.

CONTACT

Security concerns: support@zephex.dev

Billing questions: billing@zephex.dev

Legal

Security & Privacy

Last updated: July 2026. Zephex is a hosted MCP server. This page explains how API keys are protected, what request data we see, how long it is kept, and the controls in place to prevent abuse.

DATABASE & AUTHENTICATION

Supabase Postgres — accounts, API key hashes (HMAC-SHA256 + per-key salt), usage logs, billing links. Row-level security isolates customer data.
Supabase Auth — dashboard login (email/password, OAuth, magic links). MFA secrets encrypted with AES-256-GCM.
MCP tool calls — Bearer API keys only; validated per request against hashed keys in Supabase.
Operational status: zephex.dev/status · Deep dive: Authentication docs.

AUTHENTICATION

Every request requires a valid API key sent as a Bearer token in the Authorization header.
API keys are hashed before storage. Plaintext keys are never retained after generation.
Keys can be created, rotated, and revoked from the dashboard at any time.
Each key is scoped to a single account and inherits that account's plan limits.
Keys expire after 365 days by default; users can configure shorter lifetimes.
Failed authentication attempts are logged and rate-limited per IP.

WHAT ZEPHEX SEES

When you call a Zephex MCP tool, Zephex receives:

Your API key as a Bearer token, used only for authentication and discarded from memory after validation.
The name of the tool you called (one of the 10 supported tools).
The arguments you passed (such as a file path, search pattern, or URL).
Request metadata such as timestamp, hashed IP address, and User-Agent for rate limiting and abuse prevention.
The MCP client name and version from the initialize handshake (e.g., "cursor 0.50.1").

Zephex does not receive:

Your AI model prompt or full chat history.
The full contents of your repository (only the specific files referenced in tool arguments).
Your editor's surrounding conversation context.
Any data from tools you did not explicitly call.

Tool outputs pass through Zephex infrastructure before returning to your editor. Content is processed in memory and is not persistently stored.

DATA RETENTION

Data type	Retention	Purpose
API key hash	Until revoked or account deleted	Authentication
Tool name + timestamp per call	90 days	Usage tracking, billing, rate limiting
Hashed IP, editor name	90 days	Abuse detection, analytics
Tool input/output content	Not stored	Processed in memory, returned to client, discarded
Account data after deletion	Removed within 30 days	Privacy compliance

MODEL TRAINING

Zephex does not use any user data — prompts, tool inputs, tool outputs, or code accessed through the tools — to train AI models. This applies across all tiers (Free, Pro, Max).

TRANSPORT

All traffic uses HTTPS with TLS 1.3.
The MCP endpoint enforces HSTS with a 1-year max-age.
Security headers include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
Session cookies use HttpOnly, Secure, and SameSite=Strict flags where applicable.
You can validate transport posture against any URL using the audit_headers tool.

TEAM GOVERNANCE

Full rollout policy: Team MCP rollout — covers all 10 tools, plan quotas, and security review links.

Key policy	Detail
One key per person per environment	Example: cursor-dev-alice, ci-staging, prod-api-01. Never post keys in Slack, email, or public repos.
Rotate on offboarding	When a contractor or employee leaves, revoke every key they had access to in the dashboard — do not rotate the whole team unless compromised.
CI uses dedicated keys	Separate keys for automation; prefer Pro/Max tool scopes so CI cannot call tools it does not need.
Store secrets in a vault	Local .env for dev; Doppler, AWS Secrets Manager, or your CI secret store for staging/prod — never commit keys.
Name keys for analytics	Readable names make dashboard usage attribution obvious when debugging quota or abuse.

If a key is exposed:

Revoke exposed key immediately in dashboard → API Keys
Create a replacement key; update vault/CI — never reuse the leaked secret
Run mcpcli doctor or /doctor to verify editor configs still reach MCP
If editor JSON was committed: mcpcli repair or /repair for stale npx pins
Email support@zephex.dev if you suspect account-wide compromise

ACCESS CONTROLS

Dashboard authentication uses email/password with optional TOTP-based MFA.
API keys support optional IP allowlists and tool-scope restrictions on Pro and Max plans.
OAuth 2.1 with PKCE is supported for CLI-based authentication flows.
Account lockout activates after consecutive failed login attempts.
Disposable email domains are blocked at signup.

ABUSE PREVENTION

Per-user rate limiting using a token-bucket algorithm prevents burst abuse.
Per-IP rate limiting prevents credential-stuffing attacks regardless of key count.
Anomaly detection flags unusual request patterns and geographic impossibilities.
Audit logging captures authentication events and operational changes.

YOUR DATA RIGHTS

You can request the following at any time:

Access — an export of all stored personal data.
Rectification — correction of inaccurate data.
Erasure — deletion of your account and all associated data.
Portability — a machine-readable export of your data.

Submit a request from Dashboard → Settings → Privacy, or email support@zephex.dev.

VULNERABILITY REPORTING

To report a security vulnerability, email support@zephex.dev with:

Steps to reproduce
Expected vs. actual behavior
Impact assessment if known

Please do not publicly disclose until we acknowledge and address the report. We aim to respond within 48 hours.

CONTACT

Security concerns: support@zephex.dev

Billing questions: billing@zephex.dev

Quick Links

API Reference

Troubleshooting

Community

Plugins

Pricing

Security & Privacy

Quick Links

API Reference

Troubleshooting

Community

Plugins

Pricing

Security & Privacy