Privacy Policy

Statio is built for security, and this policy explains what data we collect, how we handle it, and what we will never do with it.

Effective: March 2026 · Updated: October 2026

What We Collect

  • Email address: provided when you create an account.
  • API credentials you store with Statio: stored encrypted so your agents can authenticate with third-party APIs.
  • API call logs: request metadata (caller, target API, timestamp, status) captured for audit trail purposes.
  • Usage data: aggregate metrics such as API call counts, server counts, and feature usage to operate and improve the service.
  • Device inventory: when you are signed in to the desktop app, or run mcphub audit --report, we receive the device’s hostname, a device ID, and the names, endpoints, transports and versions of the MCP servers and Claude Code extensions configured on it. Environment variables and command arguments are not sent. The desktop app sends this at startup and when a client’s configuration changes.

How We Use It

  • Provide the service: route API calls, manage credentials, enforce rate limits.
  • Enforce access policies: apply the permissions you configure for your agents and team members.
  • Generate audit trails: produce the compliance logs and usage reports available in your dashboard.
  • Communicate with you: send service updates, security notices, and billing information.

Website Analytics

  • This website (statio.dev) uses PostHog to understand how visitors use it: which pages are viewed, which links are clicked (such as sign up and download), the referring site, and your browser, device type and approximate location derived from your IP address.
  • PostHog sets a first-party cookie and local storage entry to recognise a returning browser. Visitors are anonymous; we do not attach your name or email to website analytics.
  • Website analytics are used only to improve the website. They are not sold or used for advertising.
  • You can block them with your browser’s tracking protection or an ad blocker without losing any part of the site.

Credential Handling

  • All stored credentials are encrypted at rest with AES-256-GCM.
  • Access tokens and agent tokens expire after 5 minutes and must be refreshed. Sessions can be refreshed for up to 7 days.
  • Credentials are never logged in plaintext: audit logs capture metadata only (which credential was used, not its value).
  • Credentials are transmitted over TLS and are only decrypted at the moment of proxied API call execution.

What We Don’t Do

  • We do not access your stored credentials for any purpose other than proxying your authorized API calls.
  • We do not share, sell, or provide your data to third parties for advertising or marketing purposes.
  • We do not use your API call content for model training or any purpose beyond providing the service.
  • We do not retain credentials after account deletion.

Data Retention

  • Audit logs are retained for 90 days, tool calls for 30 days and model call records for 13 months on every plan. An organization admin can shorten the first two, and Enterprise retention is set per contract, up to two years.
  • Stored credentials are deleted immediately upon account deletion or when you remove them.
  • Usage metrics are retained in aggregate form for service improvement and are not tied to individual API call content.
  • You can request a full data export or deletion at any time by contacting us.

Contact

For privacy-related questions or requests, contact us at [email protected].