This document outlines the security architecture, data handling practices, and compliance controls of the NomadMap Model Context Protocol (MCP) server. IT administrators can review this guide to approve organizational deployment in Claude Desktop, Cursor, and enterprise AI workflows.
The connector only receives the tool arguments Claude sends (e.g. a city or date) - never prompts, chat transcripts, or files. Tool arguments are processed in memory and not stored or logged. Standard web server access logs (IP address, time, URL path, user agent) are kept briefly for security and operations.
The connector operates exclusively with read-only tools (search_events, search_places, get_event_details, etc.). It cannot create, modify, or delete files, accounts, or corporate workspace data.
Access to the NomadMap discovery database is public. No API keys, SSO tokens, personal credentials, or employer identities are collected or transmitted.
All HTTP and SSE requests are encrypted in transit via industry-standard TLS 1.3 with HSTS (HTTP Strict Transport Security) enabled.
The connector only receives the specific search parameters supplied by the LLM (e.g. city: "Funchal", category: "tech", or query: "coworking"). It does not receive entire conversation histories, corporate repository code, or user identity information.
No. The connector is 100% read-only. It only queries public event, coworking, and city listings. It contains no tools or APIs for file system modification, command execution, or network scanning.
No conversation or user data is stored. Tool arguments (the search parameters) are processed in memory to answer the request and are not written to any database or log. Like any website, our web server keeps standard access logs (IP address, timestamp, URL path, status code, user agent - no request bodies) for security and troubleshooting; these are rotated and deleted automatically. Search queries are never sold or shared with advertisers or data brokers. For live court availability, the connector queries the venue's public booking provider (e.g. Playtomic, Simplifica) using only the venue identifier - no user data is sent.
In Claude, open Settings → Connectors and disconnect or remove NomadMap; organization owners can disable it for the whole organization in the admin connector settings. For manually configured clients, remove the nomadmap entry from claude_desktop_config.json or the Cursor MCP settings. No credentials are issued, so there is nothing to rotate.
The NomadMap MCP endpoint is hosted on Google Cloud Platform (Compute Engine, United States) behind an Nginx reverse proxy, served only over HTTPS (TLS 1.3, HSTS). For how personal data is handled, see our Privacy Policy.
For enterprise compliance questionnaires or security inquiries, contact info@nomadmap.io