STACK Connector for STACK IQ

STACK IQ is built on the open Model Context Protocol (MCP) — the standard for connecting AI assistants to the tools and data people already use. The MCP enables an AI assistant your organization already uses, such as Claude or ChatGPT, to work with your STACK data on your behalf. One of your users connects it by signing in on STACK’s own page and choosing which capabilities to grant. From then on, when that user asks their assistant about a project or an estimate, the assistant sends a request to STACK, and STACK returns the answer. 

Two characteristics of that design account for much of what follows. First, the direction of travel: the assistant calls STACK, never the reverse. STACK does not send your data to an AI model, and has no relationship with your AI assistant’s provider. That relationship is yours, and it governs what happens to data once it reaches the assistant. Second, the connector is an extension of STACK’s own backend rather than a separate system alongside it. It uses the same authentication, honors the same user permissions, and is logged in the same way as any other request to STACK. 

Only the data needed to answer the specific request your user made. When an assistant asks about a project, it receives that project’s details: name, status, bid date, assigned users, and the custom fields your company has defined. When it asks about takeoffs or estimates; it receives those measurements and figures. Alongside this, it can read STACK’s own product documentation, which contains no customer data at all. 

Each connector operation has a fixed, published response shape. It returns those fields and nothing else. An operation cannot return data it was not designed to return, and no operation returns your entire record set. 

Only the minimum required to fulfil the request. Responses are deliberately narrow: each operation returns a purpose-built subset of fields rather than a complete record, and results are capped so that a broad question returns a bounded answer with a clear indication that more exists, rather than an unbounded export. 

Your user also controls the scope directly. The assistant can only perform the operations they specifically authorized when connecting. Users can change which operations are authorized at any time. 

STACK does not send your data to any AI model provider. Our connector has no connection to one. It does not call a language model, and contains no AI provider integration of any kind. 

Your data reaches your AI assistant because you requested it (through your assistant), using an authorization you as a user explicitly granted. What that provider (Anthropic, OpenAI, or another) then does with it is governed by your agreement with them, not by STACK. If you need commitments about model training or retention on their side, those come from your assistant provider. 

No. Our privacy notice states this explicitly for connector traffic: information received through an AI Assistant integration “is used to carry out and secure the request you made, and is not used to train or improve our AI features ormodels.” 

 This is not merely a policy commitment; it is a structural one. The connector does not call a language model, so there is no mechanism by which connector traffic could enter a training process. 

The connector itself retains nothing. It holds no database, no cache, and no session state, and writes nothing to disk. It authenticates each request, forwards it to STACK’s backend, and returns the response. 

The connector is an extension of STACK’s backend services, and requests through it are logged exactly as any other request to STACK is logged. When your users work in the STACK application, or when your systems call our API directly, we record an operational log entry for each request: which operation, which user and company, when, from where, how long it took, and whether it succeeded. A request arriving through the connector produces the same entry, on the same terms. 

There is no additional logging because the request came from an AI assistant, and no reduced logging either. 

These operational logs are visible only to STACK. They are not exposed to the AI assistant, to its provider, or to any third party. The logging your assistant’s provider performs on its own side, including prompts, conversation history and session data, is entirely separate, sits under your agreement with that provider, and is not something STACK holds, sees, or controls. Conversely, our operational logs are not visible to them. 

Backups follow the same schedule as the rest of your STACK data, set out in the next answer. 

As published in our privacy notice: 

– Service, request, security, MCP and audit logs kept no longer than 18 months, then deleted. 

– Database backups: kept up to 365 days, then overwritten or destroyed. 

– Authorization and consent records: retained as long as needed for audit purposes. 

– Customer content: per the retention terms in our Terms of Use, including the post-termination retention period and project retention limits described there. 

Where we must keep information longer to investigate a security incident, meet a legal obligation, resolve a dispute, or enforce our agreements, we keep it for that period and then delete or de-identify it. 

In the United States. The connector runs in a single Microsoft Azure region in the eastern United States, and the data it reaches, your Takeoff & Estimate data, is hosted in the United States alongside STACK’s own product documentation. 

Its supporting infrastructure is likewise US-resident, and all traffic between the connector and STACK’s backend stays inside our private network; it never crosses the public internet.  

Depending on which STACK solution your organization uses (Takeoff & Estimate or Build & Operate), we may host your information in Canada rather than the United States. Individual subprocessors operate in their own regions, listed in the next answer.