AI Connector Privacy Notice

Last updated: August 2026

This notice describes how the Mosaic Expert Search AI connector (the MCP service at mcp.mosaicrm.com) handles data. It supplements the general Mosaic Research Management Privacy Policy, which governs Mosaic's services more broadly. The connector is available only to Mosaic clients with an enabled client-portal account.

What we process vs. exclude, in one line: we process experts' professional data — name, work history, and Mosaic's vetting write-ups (personal data, processed lawfully for expert discovery) — and we deliberately exclude every contact detail (email, phone, personal links) and any client or project identifier.

What the connector accesses and collects

• Sign-in. You authenticate with your existing Mosaic client-portal account. Your password is checked against a one-way (bcrypt) hash and is never stored or seen by the connector. Access is granted through short-lived OAuth tokens tied to your account and organisation.
• Usage / audit logs. Each request records an operational log entry: your account email and organisation, the search terms and filters you submitted, timestamps, result counts, and performance metrics. These are used for security, abuse and scrape prevention (rate limiting), and support.
• Expert data it reads. The connector reads, from a read-only copy of Mosaic's database, expert profiles, work histories, and Mosaic's vetting summaries, and returns them to your AI assistant. It cannot create, modify, or delete any record.

What it deliberately does not expose

• No expert contact details. Emails, phone numbers, and personal links are excluded from the underlying data and additionally redacted from free text before results are returned. To reach an expert, clients contact their Mosaic team.
• No client or project identifiers. Results carry no indication of which client or project an expert was previously engaged for.

How data is used and stored

Data is processed and stored on Google Cloud infrastructure in the United States. Operational logs are written to Google Cloud Logging. The connector does not use your searches or the returned data to train any model.

Third-party sharing

• Your AI provider. Search results are returned to the AI assistant you connect (for example, Anthropic's Claude or OpenAI's ChatGPT). That provider's handling of the data is governed by your agreement with them. Mosaic itself does not send your data to any AI model.
• Infrastructure providers. Google Cloud processes data on Mosaic's behalf as a service provider.
• Mosaic does not sell personal information.

Data retention

Operational and audit logs are retained for a limited period (typically 30 days) for security and support, after which they are automatically deleted. Expert and client records are retained under the general Mosaic Privacy Policy.

Contact

Questions about this notice or a data request: info@mosaicrm.com.