> ## Documentation Index
> Fetch the complete documentation index at: https://docs.civic.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Token Management

> How Civic protects your data and manages authentication

<Note>
  Your data security is our top priority. Civic handles all authentication and token management so you don't have to.
</Note>

## How We Protect Your Data

**🔒 Token Management**

* Civic securely manages all access tokens and automatically refreshes them
* Your tokens are encrypted and stored in secure, stringent infrastructure
* No tokens are ever exposed to AI clients or other users

**⚡ Authorization Control**

* You maintain full control over your app authorizations
* Revoke access to any connected service at any time
* Authorization changes take effect immediately across all your AI tools

<Card title="Managing Authorizations" icon="key" href="/civic/reference/authorizations">
  **Complete guide** - Learn what authorizations are, how to revoke access, and manage your connected services
</Card>

**🛡️ Data Access**

* Apps only access data you explicitly authorize
* AI assistants work through secure, encrypted connections
* Conversation history stored to improve the product with full encryption and security controls

## Common Security Questions

<AccordionGroup>
  <Accordion title="Where are my tokens stored?" icon="lock">
    Your access tokens are encrypted and stored in secure, stringent infrastructure. They're never exposed to AI clients, other users, or external systems beyond the authorized app connections you've approved.
  </Accordion>

  <Accordion title="What happens when tokens expire?" icon="clock">
    Civic automatically handles token refresh for all your connected services. You'll never need to manually re-authenticate or deal with expired tokens - it all happens seamlessly in the background.
  </Accordion>

  <Accordion title="Can AI assistants see my sensitive data?" icon="eye">
    AI assistants can only access data from apps you've explicitly connected and authorized. The access follows the same permissions you have in those apps - no more, no less. You control which apps to connect and can disconnect them anytime.
  </Accordion>

  <Accordion title="Is my data encrypted in transit?" icon="shield-check">
    Yes, all data transmission between your AI assistants, Civic, and your connected apps uses stringent TLS encryption. Your data is protected at every step of the workflow.
  </Accordion>

  <Accordion title="How do you ensure MCP servers are secure?" icon="magnifying-glass">
    We actively review and manage all MCP servers in our directory. Every server undergoes security review before being added, and we continuously monitor for vulnerabilities. Updates are only deployed after thorough security assessment to ensure your data remains protected.
  </Accordion>
</AccordionGroup>

## Security Features

### Infrastructure

* Data encryption at rest and in transit
* Regular security audits and penetration testing
* 24/7 monitoring and incident response

### Zero Trust Architecture

* Every request is authenticated and authorized
* Principle of least privilege access
* Automatic token rotation

### Privacy by Design

* All stored data encrypted at rest and in transit
* Privacy-focused design principles throughout the platform

### Authentication Methods

* OAuth2 for secure app authorization
* API key management for supported services
* Single sign-on (SSO) integration

### MCP Server Security Review

**Proactive Server Management**

* All MCP servers undergo rigorous security review before being added to our directory
* Continuous monitoring of server code and dependencies for security vulnerabilities
* Regular updates only deployed after thorough security assessment
* Immediate response to reported security issues with affected servers

**Our Review Process**

* Source code analysis for security vulnerabilities and best practices
* Dependency scanning for known security issues
* Authentication and authorization mechanism validation

## Security Best Practices

<Tip>
  Follow these recommendations to maximize your security when using Civic:
</Tip>

* Only connect apps you actively use
* Review and revoke unused connections monthly
* Use strong authentication methods
* Keep your AI client software updated

## Incident Response

If you suspect a security issue:

<Steps>
  <Step title="Immediate Action">
    Revoke access to any affected services through your Civic dashboard
  </Step>

  <Step title="Report the Issue">
    Join our developer community on Slack to report security issues
  </Step>

  <Step title="Monitor Activity">
    Check your connected apps for any unusual activity
  </Step>
</Steps>

## Compliance & Security Standards

### Our Approach to Compliance

Civic is built with security and privacy best practices from the ground up. We follow industry-standard security frameworks and are continuously evaluating formal compliance certifications to meet enterprise requirements.

### Security Roadmap

<Info>
  **Compliance evaluation:** Last updated September 2025
</Info>

We are actively evaluating compliance certifications to support enterprise customers:

* **GDPR compliance** - Under evaluation to meet European data protection standards
* **CCPA compliance** - Under evaluation for California consumer privacy rights
* **SOC 2 certification** - Under evaluation for enterprise security requirements
* **HIPAA compliance** - Under evaluation for healthcare use cases
* **ISO 27001 certification** - Under evaluation for information security management

### Enterprise Security

For organizations requiring specific compliance documentation or security assessments, our team works directly with enterprise customers to meet their security requirements.

<Note>
  For detailed security documentation, compliance questions, or enterprise security requirements, join our developer community on Slack
</Note>