Privacy policy

Effective November 14, 2026. Applies to the X3 Compliance MCP server at mcp.x3api.com and the open-source package.

What the server does

The server answers safety and compliance questions with read-only tools. It has no accounts, no sign-in and no database. It does not store, sell or share the questions, logs, files or other inputs you send.

What leaves the server

Most tools run entirely on the server and send nothing anywhere. Three kinds of tools call public U.S. government services to answer: the regulation tools call the eCFR at ecfr.gov, and the vessel tools call the U.S. Coast Guard's PSIX service at cgmix.uscg.mil. Only the search terms, citations or vessel identifiers needed for the answer are sent.

Hosting and logs

The remote server runs on Cloudflare Workers. Cloudflare may keep standard request logs (such as IP address and time) under its own privacy policy. X3 does not add logging of tool inputs or outputs. The local version (npx or the .mcpb bundle) runs on your own computer.

Your choices

Don't send personal information you don't need to. For example, use employee numbers rather than names in driver files and random-testing pools.

Contact

Questions or requests: open an issue at github.com/x3allamerican/x3-compliance-mcp/issues.