Security review · for whoever signs off
How SearchTrophy keeps company data safe. What we built, how we tested it, and what risk remains.
Everything on this page comes from our own production build.
Data flow
Where the data goes.
Your company
Employee's computer
- Claude Code, terminal or VS Code
- A small skill that updates itself
- The person's key, encrypted
- Exports saved as files
Your edge access gate
- Stays on every path
- No exceptions for the AI or for downloads
- HTTPS only
Thin service and your API
- The key maps to the same identity as the web app
- Role checks, ownership checks, read-only guard, redaction, audit log
- Then your data
What reaches the model provider
The question and the tool results, already limited to the asker's rights, with secret-looking fields masked. Large exports stay on the laptop as files, and the model sees only the summaries computed from them. Whether the provider keeps or trains on that text is set by the terms of your Claude plan.
Safeguards
Safeguards at each layer.
| Layer | What's in place |
|---|---|
| Keys | Made by each person in your web app and shown once. Stored only as a hash, up to five per person. Revoked keys stop within a minute. Admins see every key and its last use, and can revoke any of them. On the laptop the key is encrypted for that user and never shown to Claude. |
| Permissions | Every tool calls your own API as the asking user, so the same role checks, ownership checks and redaction protect the AI and the browser. Nothing about access control is re-implemented. |
| Read-only | AI identities can only read. Read requests that would trigger an action are denied. Credential stores are never exposed. Secret-looking fields are masked in every answer. |
| Personal data | Callers' and leads' contact details appear only when the question needs them, and are never sent anywhere else. |
| Network | The edge access gate stays on every path, with no exemptions for the AI or for downloads. |
| Audit | One log line per AI request, plus a question log with the person's question, the tool, its arguments, the outcome, size and time. |
| Off switches | Per key (revoke), per person (deactivate), and global (one live setting, no restart). |
Threats
What could go wrong, and what remains. The guarantees come from structure: the AI can't write, and it can't see more than the person asking. Instructions to the model are a second layer, never the only one.
| Threat | Safeguard | Risk that remains |
|---|---|---|
| Stolen key | The edge gate is still required. Keys can be revoked within a minute, and the person or all access can be switched off. | Someone with the laptop and gate access could use it until it's revoked. |
| Hidden instructions in calls, leads or reviews | Read-only identity, access limited to the asker, and a rule that data is information, never instructions. Other Claude Code tools keep their normal permission prompts. | The model could still be misled in what it says. It can't write or reach past the asker's access. |
| An answer that shows too much | Answers pass the same API checks as the browser. Per-record ownership checks. Endpoints narrowed to the roles that use them. Per-role tests before rollout. | An admin sees what admins see in the browser, which is a lot. |
| Runaway load | Tools shaped like questions, totals computed on the server, paging, exports for big results, and a 30-day cache for outside data. | Very broad questions take longer. They are paged or exported. |
| Tampered instructions on a laptop | Skill updates are downloaded, verified and swapped in atomically. The full guide is served by your server. | A person with admin rights on their own laptop can change local files, as with any software. |
| Someone leaves | Deactivating the user stops their keys everywhere. | Files they already exported stay on their laptop. Your device policies apply. |
| Exported files | Owner-only download with the person's own key, integrity-checked, expiring after 24 hours. | Once saved, the file sits on the laptop like any download. |
Comparison
Three ways to connect AI to company data.
| OpenClaw-style hookup | A separate AI copy of your data | SearchTrophy | |
|---|---|---|---|
| Acts as | Whoever holds the key | A service account | The person asking |
| Permissions live in | Only the key's own grants | A copy, kept in sync | Your system, unchanged |
| Copies your data | No | Yes | No |
| Can change data | Whatever the key allows | Depends on the setup | No |
| Audit trail | Whatever you add yourself | The vendor's logs | Every request and question, in your system |
| Can drift from your rules | It never had your app's rules | Yes, between syncs | No, it uses them directly |
Decision record
A personal key instead of OAuth.
The edge access gate stays on every path, with no exceptions. OAuth's discovery steps can't be guaranteed to pass that gate, while a static key always can.
So each person makes a key in the web app, pastes it once, and never logs in again. The safeguards around it are hashing, a five-key limit, revocation within a minute, an admin view with last use, deactivation, a global switch, and encryption on the laptop.
Verification
How it was tested.
- Per-role tests comparing the web API, the MCP answers and real Claude Code, with throwaway users for manager, specialist, analyst, customer service, salesperson and admin. No leaks.
- About 900 unit tests, plus protocol-level smoke tests of every tool over real MCP.
- Browser tests driven by Playwright for every screen change. One caught a key left in the page's HTML after its dialog closed, before production.
- Numbers reconciled against independent database queries: payments to the cent, exports row by row.
- The installer tested end to end in a stand-in user profile, including the skill updating itself.
Building it also made the platform safer. Auditing every read endpoint added per-record ownership checks for the browser too, and narrowed about 35 endpoints to the roles whose screens use them.
Questions
Frequently asked.
Does the model provider train on our data?
That's set by the terms of your Claude plan. SearchTrophy limits what reaches the model to what the asker may see, masks secret-looking fields, and keeps large exports on the laptop.
Can it change anything in our systems?
No. AI identities can only read, and read requests that would trigger an action are denied. Planned integrations that write, such as project management, will ask the person to confirm every write.
What is logged?
One line per AI request, plus each question with the tool, its arguments, the outcome, size and time. Your admins see it in usage insights.
Which AI apps does it work with?
It's standard MCP over Streamable HTTP. We deploy and test it with Claude Code in the terminal and in VS Code.
Where does it run?
A thin service inside or next to your existing backend, in the cloud you already use. The heavy work runs on your team's computers in Claude Code.
What happens when someone leaves?
Deactivate them in your app and their keys stop working everywhere. Files they already exported stay on their laptop, under your device policies.