Security
What we hold of yours, and what we never touch.
Minimal sits over a database you already run. That architecture decides most of this page: there is no copy of your data on our side to protect, because there is no copy.
01
The connection runs outbound-only.
No listening port is opened in your network. Minimal does not dial into your database; the connection is established from your side, outward, and every query travels back down it.
This is the answer to the question a network reviewer asks before any other: what do we have to open? Nothing.
02
No credentials are held on our side.
Your database credentials are not stored by us. There is no vault of customer connection strings to breach, because there is no vault.
03
Nothing is persisted once a query has returned.
Queries run against your database and the results are returned. There is no copy, no sync, no warehouse and no cache of your rows in between. The on-premise installation holds metadata only — configuration, not data.
04
A tool outside an identity’s scope is hidden before it can be called.
Permission is a property of the identity, not a setting on the agent. An agent granted nyc_911_calls · query cannot see the rest of the MCP server, so there is no blocked attempt to review afterwards — the call never becomes possible.
Write access is granted per action rather than switched on as a mode.
05
Every call is on the record, with the identity that authorised it.
Every call through APIs, MCP, agents and Custom API is logged: the tool, the identity, the agent, latency, payload size, and the full record of what the caller claimed against what the server verified.
Traces export to any OpenTelemetry collector on self-hosted, Jaeger included. Permissioning and audit are different things; you get both.
06
Every change is versioned, and reversible.
Every change to an org, project, Custom API, module or space is versioned. An admin rolls a dangerous one back with a click, without a support ticket.
07
You can see the whole reach on one diagram.
The Access Map draws identities, the tools they reach and the API sources behind those tools, with high-reach identities flagged. It is the artifact to bring to a review — not a settings page you have to narrate.
08
Air-gapped deployment is available.
Free, Pro and Scale are hosted. Enterprise deploys hosted or on-premise, and air-gapped on-premise is available on that tier.
The boundary
What stays yours.
We do not do your authentication. Identities in Minimal govern what reaches your data through Minimal. Signing in your own end users, and everything that follows from it, stays yours to build, manage and maintain.
We do not secure your database. Network placement, patching, encryption at rest, backups and the credentials themselves are yours. Minimal reduces what has to be exposed; it does not replace the controls around what it connects to.
Every claim here is also a commitment there.
Incident handling, sub-processors, data-protection roles and retention are written into the Terms rather than described here.