Ethnio MCP security for IT and TPRM reviews 🔐
If your organization would like to use the Ethnio MCP, here are some resources for common questions and technical details that might be helpful to share. The Ethnio MCP lets each person connect their own AI assistant to Ethnio, and no participant PII ever reaches the AI model. This article is for security and third-party risk management (TPRM) teams reviewing the connector before approving it.
For setup and everyday use, see All about the Ethnio MCP.
| Topic | Summary |
|---|---|
| Type | Official remote MCP hosted by Ethnio (not open source) |
| Authentication | OAuth, authorized individually by each user |
| Access | Mirrors each user's existing Ethnio permissions |
| Participant PII sent to AI | None. Details are masked or withheld before results leave Ethnio |
| Participant emails | Sent only after explicit confirmation |
| Permanent deletion of studies | Not possible. Studies can only be archived |
| Incentive payments | Not available through the MCP |
| Hosting | AWS US West (Oregon) |
| Certification | SOC 2 Type 2 |
🧭 How data flows
Your AI assistant only talks to the Ethnio MCP, which checks the user's permissions and swaps participant details for tokens before anything goes back to the model. Real details are restored inside Ethnio only when a confirmed action sends something to a participant.
🔐 Authentication and access
Every connection belongs to one person, who authorizes it with their own Ethnio login through OAuth. Connections are never shared across a team, and the connector can never do more than that person can already do in Ethnio.
How a connection is created
- The user adds the Ethnio MCP as a connector in their AI assistant.
- They sign in to Ethnio and approve the access the assistant is requesting.
- Ethnio records the grant against that user, along with its scopes and the date it was authorized.
Scopes and permissions
Each grant carries named scopes, for example Read studies and Create and edit studies. Every action also runs through the user's Ethnio permissions. If someone can't edit a study in Ethnio, the connector can't edit it either.
Visibility and revocation
- 👀 Users see every AI client connected to their account under Integrations › MCP for AI Assistant › All connected clients.
- 🚫 Revoking a client signs it out of Ethnio, and it must be re-authorized to connect again.
- 🔄 Access is revoked automatically when the user's role changes.
- 👋 Removing someone from your Ethnio account removes the connector's access with it, because every action runs as that user.
🎭 What the AI can and can't see
Ethnio masks participant details on its own servers before any result leaves Ethnio, so the AI model only ever handles placeholder tokens. Think of it like a coat check: the AI holds the ticket, and the real details stay with Ethnio. The full approach is in How Ethnio never shares PII or PHI with AI.
How masking works
- The AI assistant calls an Ethnio tool, such as looking up an appointment.
- Ethnio replaces each sensitive detail with a meaningless token, like
[tokenBsf]. - The AI reasons and drafts using tokens only.
- When an action needs the real details, such as sending an invite, Ethnio swaps them back in on its side after the AI is done.
Field by field
| Data | What the AI receives |
|---|---|
| Participant first name | First three characters only |
| Participant last name | Masked token |
| Email address | Masked token |
| Phone number | Masked token |
| Gift card and redemption links | No access in MCP |
| Any attribute flagged PII or PHI | Masked token |
| Study details (name, stage, status, response count, incentive amount) | Visible |
| Screener questions and answer choices | Visible |
| Calendar slots and their status | Visible |
| Quotas and live progress | Visible |
🔐 Privacy Characteristics of Pool Attributes
Every participant has "attributes" in Ethnio, which is all their metadata, answers to screeners or surveys, anything uploaded about them, payment history, etc. Account owners and admins can flag any custom participant attribute as PII or PHI under Pool › Data › Attributes.
Built-in protections
- 🔍 Participant search only matches exact values, like a full email address or a participant ID. Partial searches never match, so search can't be used to guess identities.
- 🔒 Masking can't be turned off by any user or admin, in any AI client.
- 🧠 Since real details never reach the model, there's nothing identifying for an AI provider to retain or train on.
✍️ Actions and guardrails
The MCP can change scheduling and study setup, but anything that reaches a participant needs explicit confirmation first. Ethnio enforces that confirmation on its side, so no prompt or client setting can skip it.
| Area | What the MCP can do | Guardrail |
|---|---|---|
| Studies and participants | Search and view studies, and look up a participant's appointments | Participant details masked |
| Calendar | View up to 7 days at a time and manage time slots | Confirmation before changing a slot with active appointments |
| Participant contact | Invite, re-invite, confirm, ask to reschedule, reschedule, cancel, resend details | Confirmation before anything is sent |
| Study editing | Create and update studies, including questions in the beta editor | Follows the user's edit permissions |
| Study removal | Archive and unarchive | No permanent deletion |
| Quotas | List, create, update and delete | Follows the user's edit permissions |
| Incentive payments | None | Not available through the MCP |
Two layers of approval
- ✅ Ethnio's confirmation covers participant emails and live appointment changes. It's always on.
- 🙋 Your AI assistant's approval settings let each user require approval before any Ethnio action, for example asking every time before creating a study. This is an extra layer the user controls.
What it can't do
- Reveal full participant names or contact details
- Permanently delete a study
- Edit questions on studies built in the classic editor
- Skip confirmation for participant emails or live appointments
🏢 Data ownership, hosting and compliance
Your organization owns its participant data, and Ethnio processes it on your behalf. On intake forms, the data owner is the person at your organization accountable for participant data, usually a Research Ops or UXR lead.
Where the AI provider fits
With the MCP, your AI assistant calls Ethnio, not the other way around. Ethnio doesn't send participant data to any AI provider on its own. Your AI vendor receives only masked tool results, under your organization's existing agreement with that vendor.
Hosting and certifications
- ☁️ Customer data is hosted in AWS US West (Oregon), a SOC 2 Type 2 accredited data center.
- ✅ Ethnio holds SOC 2 Type 2 certification
- 🔒 Data is encrypted in transit and at rest.
- 📜 Ethnio adheres to major data protection regulations, including GDPR and HIPAA. See Compliance and Security for details.
Security documentation
Email your Ethnio account contact or info@ethn.io for our SOC 2 report and DPA. We're also happy to complete your team's security questionnaire.
📋 Copy-ready answers for intake forms
Paste these straight into an MCP or vendor access request.
| Question | Answer |
|---|---|
| Type of MCP | Official external MCP, hosted by Ethnio. Not open source. |
| Auth model | Per-user OAuth. Access mirrors each user's existing Ethnio permissions, with no elevated access. |
| Is each connection unique to the person? | Yes. Each user authorizes their own connection and can view or revoke it under Integrations › MCP for AI Assistant › All connected clients. |
| Is participant PII sent to the AI? | No. Participant details are masked before leaving Ethnio. Only the first three characters of a first name ever appear. |
| Are phone numbers masked? | Phone numbers are always masked and never passed to AI. |
| Is financial data read or updated? | No. The MCP can see a study's incentive amount but can't send or change payments. |
| Can it delete data? | Only scheduling and setup items like time slots and quotas. Studies can be archived but never permanently deleted. |
| Does it contact participants? | Only after the user explicitly confirms each send. |
| Who is the data owner? | Your organization, typically the Ethnio account owner |
| How is access removed? | Revoke the MCP client in Ethnio, or remove the user's Ethnio account. Either terminates MCP access. |
| Where is data hosted? | AWS US West (Oregon). |
| Certifications | SOC 2 Type 2 |
💬 Still have questions? Our team is happy to join a call with your security reviewers.