Security & Privacy - Extralt Docs

Extralt is designed with data isolation and security as core principles. Every layer of the platform — from authentication to storage to billing — enforces strict org-scoped boundaries so your data stays private.

Organization isolation

Customer operations and data are scoped to an organization. This includes Robots, Runs, Captures, Enrichments, Items, materialized entities, credits, API keys, and MCP connections.

API keys only access data within their organization
MCP connections only access the organization selected during OAuth consent
Users in one org cannot see another org's data
Even if you have multiple orgs, each is a separate, isolated environment

API and MCP authentication

The public REST API accepts organization-scoped API keys. MCP accepts OAuth access tokens and resolves the selected organization on every request. API keys are not accepted by MCP, and OAuth access tokens are not accepted by the REST API.

API keys

Keys are generated per organization from the dashboard
Each key is scoped to one organization
Keys can be revoked at any time
Compromised keys should be revoked and replaced immediately

Best practices:

Store keys in environment variables, not in code
Never commit keys to version control
Use separate keys for development and production
Rotate keys periodically

MCP connections

MCP authorization happens in the browser. Sign in, select the organization the client should use, and approve the requested access. Extralt never accepts an organization ID from a tool call as proof of access.

Billing security

Billing is handled entirely by Stripe, a third-party payment processor. Extralt never stores, processes, or has access to your credit card information or payment details.

When you subscribe or manage your billing, you're redirected to Stripe's secure interface.

Data handling

Extracted and processed records retain organization ownership throughout the pipeline
Dashboard, public API, and MCP requests apply the authenticated organization context
Exports and dashboard AI queries only return data in the authenticated organization
Extralt extracts supported public ecommerce pages; authentication does not grant the crawler access to private source data

See Access Surfaces for the exact capabilities of the dashboard, public API, MCP, exports, dashboard AI queries, and dashboard agent.

Questions

If you have security questions or need to report a vulnerability, contact us at support@extralt.com.