MCP Security: Access Model, GDPR & Multi-Tenancy

Querying your information system in plain language — "Which applications depend on our ERP?", "What business processes go through Salesforce?" — is now possible thanks to the MCP standard (Model Context Protocol). But as soon as you talk about connecting an AI assistant to internal data, security concerns arise — and rightly so. This article addresses the most common objections raised by CIOs and CISOs, and explains how UrbaHive designed its MCP connector -- least privilege, per-organisation isolation, audit log, hosting in the European Union -- to serve as groundwork for a GDPR, NIS2 or DORA effort.

Why CIOs and CISOs question MCP security

The Model Context Protocol lets a large language model (LLM) query an external data source in real time. In the context of enterprise architecture mapping, this means Claude can query your architecture repository to answer concrete business questions.

Three concerns come up consistently:

1. Can the AI modify my data? A poorly configured assistant could theoretically create, edit, or delete items in your architecture map.
2. Where does data go? If the MCP server is hosted outside the European Union, your IT landscape data flows outside the GDPR perimeter.
3. Who can access what? In a multi-tenant environment, can a compromised token expose another organisation's data?

These are legitimate questions. They deserve precise answers, not generic reassurances.

Principle 1: least privilege — read by default, write under conditions

UrbaHive's MCP connector follows the principle of least privilege. By default, a token is read-only: it exposes only consultation operations — list applications, read a server record, query a business process. Write is optional and is only enabled at token creation (the "write" scope), under a double condition: the token's scope and a sufficient role (Owner/Editor for typologies, Owner/Editor/Member for elements; Viewers stay read-only). No delete route is ever exposed, whatever the token.

In practice: a read-only token has any write attempt rejected at the protocol level. Write is only possible if you explicitly authorised it — useful, for example, to let an agent bootstrap your map from code (see the dedicated guide). This is not a fragile orchestrator-side guardrail but a server-side constraint: scope + role are checked before any write.

This model follows the principle of least privilege, recommended by European security agencies and embedded in information system security frameworks. For analytical use — understanding your IT landscape, preparing an audit, onboarding a new team member — a read-only token is entirely sufficient; only enable write when you actually need it.

Principle 2: strict multi-tenant isolation

UrbaHive is a multi-tenant SaaS platform. Each organisation has its own isolated data space. The Personal Access Token (PAT) generated for the MCP connector is bound to a single organisation: it can never cross tenant boundaries.

Concretely:

• A token generated for organisation A can only query organisation A's data.
• Token revocation is immediate from the UrbaHive interface.
• Token lifetime is configurable, in line with secrets management best practices.

This architecture is in line with the data segregation expected by GDPR (Article 25, privacy by design) and by security frameworks such as ISO 27001. Each token is also limited to 60 requests per minute.

Principle 3: complete audit trail

Every MCP call — every question asked by the AI assistant — is logged in UrbaHive's audit journal. Each log entry contains: timestamp, token identifier, queried endpoint, and the result returned (success or error).

This traceability is essential for:

• Supporting a GDPR review or NIS2 audit with a record of accesses
• Detecting abnormal usage (unusual request volume, out-of-context access to sensitive data)
• Meeting requirements for logging access to personal data

For organisations subject to DORA or NIS2, this logging provides a useful record for the obligations to monitor access to critical systems; it is consulted in the app, with filters, but cannot be exported. We cover this in depth in our articles on NIS2 and IT mapping and DORA for the financial sector.

Principle 4: hosting in the European Union

UrbaHive, MCP server included, is hosted on Vercel and Supabase, in European Union regions only: your IT architecture map data is stored in the EU, encrypted in transit (TLS) and at rest.

This matters for organisations that:

• Operate in regulated sectors (banking, insurance, healthcare, public administration)
• Have adopted an EU-preference policy for hosting their data
• Must justify their sub-processor chain under GDPR (Article 28, data processing agreement)

Backups are encrypted, kept for 30 days, and their restoration is tested every month. For HDS or SecNumCloud needs, the Enterprise plan offers an on-premise hosting option (Kubernetes/Docker).

What MCP does not do — limits to be aware of

Transparency requires acknowledging what the MCP connector does not cover:

• It does not encrypt data within Claude. Once data is transmitted to the language model (Anthropic), it is subject to Anthropic's privacy policy. UrbaHive recommends not exposing personal data or classified information via MCP.
• It does not replace a human architecture review. AI responses are a starting point, not a final decision.
• Client-side security is out of scope. If a PAT token is stored in plain text on an unsecured device, the risk originates there.

For more on the relationship between IT mapping and cybersecurity, see our article IT mapping and the CISO role.

How to activate the MCP connector on UrbaHive

Setup takes less than ten minutes:

1. Log into your UrbaHive account and navigate to Settings > Connectors.
2. Generate a Personal Access Token (PAT) — pick the target organisation and its lifetime, and only enable write (the "write" scope) if you need it.
3. Copy the provided JSON configuration.
4. Paste it into Claude Desktop (the claude_desktop_config.json file) or into claude.ai's MCP settings.
5. Ask your first question in plain language.

The MCP connector is included in every plan, including the Free plan (€0, 25 applications, 1 user, no time limit). The Starter (€29/month, 100 applications, 5 users) and Professional (€99/month, 200 applications, 25 users) plans differ only in their quotas.

Conclusion

Connecting an AI assistant to your IT architecture map via MCP can be done rigorously and securely — provided you choose an implementation that respects four principles: least privilege (read by default, write under conditions), tenant isolation, complete traceability, and EU hosting. That is precisely what UrbaHive has built.

For CIOs and CISOs who want to move forward without compromising on security, UrbaHive's MCP connector offers a concrete path to AI that is useful, traced, and under control.

Create your free UrbaHive account and set up your MCP connector in under ten minutes.

FAQ

Can the MCP connector write to or modify data in UrbaHive?

By default, no: a token is read-only. Write is only possible if you explicitly enable it at token creation (the "write" scope) and if the user has a sufficient role (Owner/Editor/Member). No delete operation is ever exposed. To stay strictly read-only, simply don't enable the "write" scope.

Does my IT architecture data leave the European Union?

Data passes through UrbaHive's MCP server, which is hosted in the European Union. It is then transmitted to the language model (Anthropic), whose servers are in the United States. UrbaHive recommends not exposing personal data or classified information via the MCP connector.

How do I revoke a MCP token if I suspect a compromise?

From the UrbaHive interface (Settings > Connectors), revocation is immediate. The token is invalidated at once; any subsequent request using that token will be rejected.

Is the MCP audit log accessible to my security teams?

Yes. MCP calls are integrated into UrbaHive's audit log, which is consulted in the app with filters, alongside every creation, modification and deletion in the repository (with before and after values). The log cannot be exported: it does not feed a SIEM, but it lets you show who did what when an audit request comes in.

Does the MCP connector have a place in a NIS2 or DORA effort?

UrbaHive has no compliance feature. However, NIS2 and DORA presuppose knowing your assets, their dependencies and who is responsible for them, and tracing access: the repository, the audit log (every MCP call is recorded in it), per-organisation isolation and EU hosting provide that groundwork. See our dedicated guides on NIS2 and DORA for a full breakdown.

Internal links:

• MCP pillar guide
• What is the Model Context Protocol?
• Connecting Claude to your IT map
• NIS2 and IT mapping
• DORA and IT mapping
• IT mapping and cybersecurity (CISO)