AI Connector Privacy Notice

Last updated: October 2026

This notice describes how the Mosaic Expert Search AI connector (the MCP service at mcp.mosaicrm.com) handles data. It supplements the general Mosaic Research Management Privacy Policy, which governs Mosaic's services more broadly. The connector is available only to Mosaic clients with an enabled client-portal account.

What we process vs. exclude, in one line: we process experts' professional data — name, work history, and Mosaic's vetting write-ups (personal data, processed lawfully for expert discovery) — and we deliberately exclude every contact detail (email, phone, personal links) and any client or project identifier.

What the connector accesses and collects

• Sign-in. You authenticate with your existing Mosaic client-portal account. Your password is checked against a one-way (bcrypt) hash and is never stored or seen by the connector. Access is granted through short-lived OAuth tokens tied to your account and organisation.
• Usage / audit logs. Each request records an operational log entry: your account email and organisation, the search terms and filters you submitted, timestamps, result counts, and performance metrics. These are used for security, abuse and scrape prevention (rate limiting), support, and so your Mosaic team can see how the connector is being used for your account. Where your organisation's agreement with Mosaic requires it, the search terms, filters and expert lookups are withheld from these records and only the account, timestamps, result counts and performance metrics are kept.
• Expert data it reads. The connector reads, from a read-only copy of Mosaic's database, expert profiles, work histories, and Mosaic's vetting summaries, and returns them to your AI assistant. It cannot create, modify, or delete any record.

What it deliberately does not expose

• No expert contact details. Emails, phone numbers, and personal links are excluded from the underlying data and additionally redacted from free text before results are returned. To reach an expert, clients contact their Mosaic team.
• No client or project identifiers. Results carry no indication of which client or project an expert was previously engaged for.

How data is used and stored

Data is processed and stored on Google Cloud infrastructure in the United States. Usage records are stored in Mosaic's own database and in Google Cloud Logging. The connector does not use your searches or the returned data to train any model.

Third-party sharing

• Your AI provider. Search results are returned to the AI assistant you connect (for example, Anthropic's Claude or OpenAI's ChatGPT). That provider's handling of the data is governed by your agreement with them. Mosaic itself does not send your data to any AI model.
• Infrastructure providers. Google Cloud processes data on Mosaic's behalf as a service provider.
• Mosaic does not sell personal information.

Data retention

Usage and audit records are kept for up to 13 months (12 months in Mosaic's database, up to 400 days in Google Cloud Logging) and are then automatically deleted. Expert and client records are retained under the general Mosaic Privacy Policy.

Contact

Questions about this notice or a data request: info@mosaicrm.com.