MSC Integration Docs
Security and data handling
- Isolation. Multi-tenant with row-level security enforced in the database, and no shared AI context between customers. Single-tenant or MSC-hosted Azure deployment is available.
- Data residency. US-hosted.
- No training on MSC data. MSC data is not used to train shared or third-party models without written consent. Model providers operate under zero-retention terms.
- Encryption. TLS 1.3 in transit. AES-256 at rest, including backups, with managed key rotation. Customer-managed keys are available.
- Commercial data. Customer numbers are tokenized and never reach suppliers. Cost and margin are visible only to internal sourcing roles.
- Access. SSO through MSC's Entra ID, one scoped service account per integration, and no standing access for Faction staff.
- Audit and oversight. Every value carries its source, timestamp and actor in an append-only, exportable record. ERP writes and customer-facing sends need human approval until MSC chooses to automate.
- Compliance. SOC 2. Third-party penetration test completed March 2026. On exit, MSC receives a full data export and a signed deletion certificate.