Security
A practical view of how Vagle AI protects accounts, credentials, MCP/API tokens, call logs, transcripts, recordings, and connected tools. Last updated: July 1, 2026.
Account protection
Vagle AI uses user authentication, workspace access controls, admin permissions, and session protections to help protect business accounts and call data.
Workspace and tenant separation
Workspace data is separated by account, organization, and workspace context where applicable. Users should only see the data their workspace role allows them to access.
API keys, OAuth tokens, and MCP tokens
Provider keys, OAuth tokens, connected tool credentials, and MCP/API tokens are treated as sensitive. We protect them with access controls and encryption where applicable, limit access based on workspace permissions, and avoid exposing raw secrets in normal responses.
MCP tokens are intended to be shown only at creation time. After that, stored token records should use hashed token values and display only safe metadata such as prefix, scopes, status, and timestamps.
Call logs, transcripts, and recordings
Call logs, transcripts, summaries, recordings where enabled, detected outcomes, and tool actions are available based on workspace access. Customers should assign access carefully because this data can contain personal or business information.
Tools, webhooks, and external actions
Tool Workspace actions are designed to run only with configured credentials, selected fields, and scoped workspace permissions. Webhooks and HTTP tools should be configured with safe endpoints, limited payloads, and no secrets in visible fields.
Where available, tool execution logs should redact secrets such as Authorization headers, cookies, API keys, OAuth tokens, provider keys, and credential identifiers.
Audit logging and monitoring
The platform uses practical controls such as audit logging, webhook validation, tool access checks, error monitoring, rate limiting where applicable, and scoped MCP/API permissions.
Audit logs are intended to help review important actions without exposing raw secrets. MCP/API tool responses are designed to return only the data needed for the requested action and to keep credentials, authorization headers, provider keys, and raw tokens out of normal responses.
Security certifications
We are continuously improving security as the platform scales. We do not claim SOC 2, ISO, or similar certifications unless and until they are formally completed.
Report a concern
To report a security concern, contact info@vagle.ai.