Commerce Gate security and data governance

Data used for policy checks

A check uses the facts its policy needs, such as SKU, proposed price or quantity, landed cost, order amount, refund amount and a non-secret actor identifier. Send only those. Platform connections read only the records your granted permissions allow.

The published MCP sends its tool inputs to the Decionis API over HTTPS; its privacy documentation describes no general browser, clipboard or file reader. Your MCP host may keep tool-call history under its own policy, so review its settings too.

• Decionis privacy policy

  Applicable privacy terms and data-rights information.

• Model Context Protocol architecture

  MCP separates host, client and server responsibilities. A server's exposed tools determine what it can do; protocol support alone does not grant execution permission.

Accounts, credentials and permissions

Decionis Accounts controls sign-in and workspace access. Keep integration keys in private client configuration or your secret store, never in a prompt, example, public repository or shared log.

A connected platform and a passed policy check are not enough on their own. The action must also be built, covered by your permissions, turned on and authorized by you. A go-ahead answer is not your consent to act.

• Check platform permissions and release status

  Connection status alone is not proof that an action can execute.

How to review decision evidence

A Decision Dossier describes a recorded policy decision where the platform provides one, and a proof packet helps you review it. Some observations, operator-confirmed actions and outage fallbacks have no signed dossier, and an ERP answer does not promise a retrievable dossier.

• Match the record to the organization, proposed action, policy and time you intend to review.
• Inspect the returned signature-verification status. Keep verified, partial and missing evidence distinct.
• Review the outcome and any required approval without treating the signature as a guarantee that the supplied facts were correct.
• Check the platform's action receipt separately. A verified decision is not proof that an order shipped or a refund completed.

• MCP dossier and proof-packet tools

  Read evidence for records your organization can access.

• Evidence and outcome terminology

  Definitions used throughout the product documentation.

Human approval and verification

Where an action can escalate, the approver you name reviews the pending request through your approval route, normally with Presence where supported; some integrations allow a local-operator fallback you set up. Confirming who approved, the approval itself and the action going through are separate facts.

FIDO2 and WebAuthn are authentication standards. The link explains the terms; it does not mean every approval needs a passkey or that every workspace verifies the same way.

• FIDO Alliance: passkeys, FIDO2 and WebAuthn

  Passkeys use FIDO standards for authentication. The verification method used for an approval depends on the configured flow.

Retention, data rights and security reports

Retention follows your Decionis plan and privacy policy, so ask for the terms for your workspace rather than assuming a fixed number of days. Removing a local MCP client does not delete decision records on the server.

Send access, correction or deletion requests to commerce@decionis.com. Report a suspected vulnerability to security@decionis.com, without keys or customer records. The security contact file lists the published reporting contact.

• Published security reporting contact

  Security-reporting contact and canonical location.

• Email a security report

  Provide a minimal description and a safe way to reproduce the issue.