Is PrivacyFence an MCP gateway?
Yes, with a difference. PrivacyFence is the MCP server your AI client connects to for Gmail, Drive, Slack and your other services. Every tool call passes its policy first: sensitive reads and changes wait for human approval, an optional local PII check runs before personal data reaches the AI, and every decision is audited. Connector credentials stay with PrivacyFence, never with the AI client.
Unlike a general-purpose MCP gateway, it governs defined connectors and the operations each one supports, each with a gate fixed in code. It is not a generic proxy for arbitrary MCP tools.
PrivacyFence and other MCP gateways compared · What each connector can do
Does my data go through PrivacyFence's servers?
No. PrivacyFence runs on your own computer, or on a server your organization controls. Every tool call goes from there straight to the provider: Google, Slack, Salesforce, Atlassian, Telegram, Grist or your Peek server. No hosted service sits in the data path, and your connector sign-ins stay with PrivacyFence, never with the AI client. With PrivacyFence's built-in apps, only the sign-in redirect passes through the PrivacyFence relay; an organization's own apps never touch it.
The AI client itself is a different matter: whatever you approve is sent to the AI, under that AI provider's terms. PrivacyFence decides what reaches it. How this fits the GDPR.
This website is separate from the product. It uses Google Analytics, only if you accept it in the cookie banner; the privacy policy says what it collects.
Which AI clients work?
PrivacyFence is tested with these clients, and any MCP-compatible client can connect:
Web clients (claude.ai, ChatGPT on the web and Gemini Enterprise) reach PrivacyFence only through an organization deployment, because on a single computer PrivacyFence listens only on that computer. On your own computer, use Claude Desktop, Claude Code or ChatGPT desktop on macOS. AI agents has a page for each client, with how it connects and what it asks you, and links its setup steps.
What does the AI see before I approve?
Only what it already had: the tool it called, the arguments it sent, and a status telling it to wait. PrivacyFence may fetch the content first, to build your card and check it for personal data, but that content stays inside PrivacyFence until you allow it. If you deny, the AI gets nothing from it.
Lookups that disclose little, such as searching email subjects or listing files, run without a card and are audited. Which tools those are is fixed in code and listed per connector on Connectors.
What the AI sees before approval
Can routine requests run without approval?
Yes, within limits you set. An always-allow rule lets matching requests run without a card: mail from your company's domain, one Drive folder, one Slack channel, one Jira project. You can add one from a card's Always allow button, from Settings, or by letting the assistant propose it for you to confirm. Every request a rule lets through is still audited.
Rules only ever add permissions, and they cannot overrule the PII check: a read with likely personal data in it still comes to you. For scheduled work with nobody watching, a run can declare itself unattended, so anything no rule covers is refused at once instead of waiting.
Always-allow and policy rules
Is PrivacyFence certified?
No. PrivacyFence has no security certification, no business-continuity plan and no service-level agreement. It is open-source software that you run yourself, so the only infrastructure the maintainer operates is the download service and the sign-in relay, and neither sees your tokens, mail or files. Installed copies keep running without the maintainer. New sign-ins with the built-in apps on a server depend on the PrivacyFence relay, which carries only the sign-in redirect; existing connections and your own apps do not.
Using it does not by itself satisfy a regulation or a contract either: that depends on your configuration, identity provider, retention and your own assessment. Where policy asks for a certification, organizations typically approve PrivacyFence through an exception process, pin a reviewed release, and assign an internal owner to track releases.
What PrivacyFence does not claim
Single-user, organization or desktop mode?
PrivacyFence 7 deprecates desktop mode, and PrivacyFence 8 removes it. Desktop installs keep working through 7.x, without the built-in apps. Move to the Docker image on your computer or to an organization server (moving to organization mode).
Single-user mode runs PrivacyFence's Docker image on one person's computer. It is published only on localhost, and set up with a one-time code from the container's log, then a passkey. Single-user mode is no protection against an AI agent that can run docker on that computer: whoever can run docker can read the setup code from the log or open the data volume. Run it under a separate account with rootless Docker or in a virtual machine, or use an organization server. How to install it.
Organization mode runs one PrivacyFence on a Linux server your organization controls, from environment variables in Docker or under systemd, behind HTTPS. People sign in through your organization's OpenID Connect identity provider, or, for a small Google Workspace team, through PrivacyFence's built-in Google sign-in, which needs nothing registered at Google and admits only verified Workspace accounts. Administrators set the privacy filter and PII check for everyone on the Admin page, and web clients can connect too.
Desktop and organization mode side by side
Do I have to register an app with Google, Slack and the others?
PrivacyFence ships its own apps for Google, Slack, Salesforce, Atlassian and Miro, so an organization server, or the Docker image on your own computer, connects them with nothing to register. An organization may register its own app with any of them instead and upload it on the Admin page; its own apps never touch the relay.
The relay at oauth.privacyfence.eu forwards the browser's sign-in redirect (a one-time authorization code and the state) to your server. It never sees a token, keeps no logs and stores no code: your server exchanges the code with the provider itself.
Until Google verifies PrivacyFence's Google app, people see Google's unverified-app screen, and the app is limited to 100 users across all installs; an organization that needs neither registers its own Google app. Built-in apps through the relay
Is it free?
Yes. PrivacyFence is open source under the Apache License 2.0, with no paid tier, no account and no commercial offering. The services you connect are your own accounts with Google, Slack, Salesforce, Atlassian, Telegram, Grist or Peek, on whatever plan you already have.
Source code on GitHub
How do I verify a download?
The download page lists the SHA-256 checksum of every installer. Compute the checksum of the file you downloaded and compare the two before running it; if they differ, do not run the file.
shasum -a 256 <file> # macOS
sha256sum <file> # Linux
Get-FileHash <file> -Algorithm SHA256 # Windows
Stable releases are also signed: the macOS installer is signed and notarized by Apple, and the Windows installer is Authenticode-signed. Pre-release builds may not be. Each install guide has the exact command: macOS, Windows, Linux.
