# Security and data

> What an agent connected to FoodPerfect can see and do, where data goes, and the terms that apply to API and MCP use.

## What a connected agent can access

An API key opens **one** FoodPerfect account, the one that created it, and only through the tools its [scopes](/docs/authentication/#scopes) allow. Through those tools an agent can see:

- account plan, subscription status and balance
- Brand DNA: voice, pillars, goals, post types
- your generated images and videos, uploaded assets and reel templates
- scheduled posts and their status

It **can't** see payment details, your password, other users' data, or your social accounts' login tokens. Social accounts are connected through our publishing partner and the tokens never pass through the MCP server. Comments and DMs aren't available over MCP.

## What leaves FoodPerfect

When your agent calls a tool, the tool's results go to **your agent's provider** (for example Anthropic, OpenAI or Cursor) under your agreement with them. FoodPerfect doesn't control how they process it. Connect FoodPerfect only to AI providers you trust with your brand's content.

Inside FoodPerfect, tool calls are handled exactly like actions in the app, by the same [subprocessors](https://app.foodperfect.ai/legal/subprocessors.md): image and video generation providers, our publishing partner, and Google Cloud.

## How keys are protected

- Keys are random 256-bit secrets with an `fp_live_` / `fp_test_` prefix. We store only a SHA-256 hash.
- Keys can be scoped, given an expiry, and revoked instantly.
- Each key has its own rate limit, and every call is logged with a request id.
- All traffic is HTTPS.

Report a vulnerability or a leaked key to [security@foodperfect.ai](mailto:security@foodperfect.ai).

## Your responsibilities

- Keep keys secret. **Anything done with your key is treated as done by you**, including spending your balance and publishing.
- Review what your agent publishes. Approval tokens exist so a human can say yes, and it's up to your agent setup to ask you. See [Approvals](/docs/approvals/).
- Only publish content you have the rights to, including anything imported with `scrape_trending_hooks`.

## Terms that apply

Using the API and MCP server is covered by the same terms as the app:

- [Terms of Service](https://app.foodperfect.ai/legal/terms-of-service.md) (§8, *MCP Server, API, and AI Agents*)
- [Acceptable Use Policy](https://app.foodperfect.ai/legal/acceptable-use-policy.md)
- [Privacy Policy](https://app.foodperfect.ai/legal/privacy-policy.md)
- [AI Content Policy](https://app.foodperfect.ai/legal/ai-content-policy.md)
- [Billing and Refund Terms](https://app.foodperfect.ai/legal/subscription-terms.md)
- [Data Processing Agreement](https://app.foodperfect.ai/legal/dpa.md) and [Subprocessors](https://app.foodperfect.ai/legal/subprocessors.md)