Security and data

What PorchQ does

Sign-in

• OAuth 2.1 with PKCE, S256 only. Codes and tokens are bound to https://porchq.com/mcp (RFC 8707), and every redirect carries iss (RFC 9207).
• The consent page is never skipped. The person sees where the app’s details came from, where they’ll be sent back, and a warning when the app runs on their own computer.
• Only people with a confirmed email address and an active account can connect.
• Codes and tokens are stored as SHA-256 hashes. One issued before 13 October 2026 is rewritten as a hash the first time it is used.
• Access tokens last 60 minutes. Refresh tokens rotate on every use; reusing a retired one ends the connection, and a connection unused for 60 days ends.
• Client ID metadata documents are fetched over https from public addresses only, with size and time limits and no redirects.

Every call

• A call acts as the person, in one community, with their role there. The checks are the ones PorchQ’s own website and apps apply.
• A connection reaches only the communities and scopes the person chose.
• Requests are rate-limited per token and per address, and changes per person.
• Requests from web pages are accepted only from known origins.

Changes

• Changes go through the same services as PorchQ’s website and phone apps, with the same validations and notifications.
• Announcements are only ever saved as drafts; a person publishes them in PorchQ.
• No tool moves money.

What an app receives

Only what the person can see in PorchQ, in the communities they chose. Depending on the tools an app calls, that includes:

• the community’s details, the person’s role and unit, and counts of open requests, announcements, events, ballots and documents;
• published announcements, upcoming events and ballots;
• names, email addresses and units of members (resident directory, owners and managers only);
• maintenance requests, with notes residents wrote;
• documents’ titles and descriptions, and links that open only for someone signed in to PorchQ;
• meeting note summaries (owners and managers only);
• the community’s PorchQ plan and subscription (owners and managers only).

The record PorchQ keeps

Every tool call is recorded: who, which app, which tool and community, the effect, when, and how it ended, with the IP address it came from. Free text (titles, descriptions, bodies, search words) is never stored in this record; ids, settings and numbers are.

Handling PorchQ data well

If you build an app that connects to PorchQ:

• Ask before changing things. Use the tool annotations (readOnlyHint, destructiveHint) and confirm with the person before a change, especially one recorded as send.
• Use idempotency keys for every change, so a retry never files a second request or creates a second event.
• Keep tokens secret. Store them encrypted; never put them in URLs, logs or error reports.
• Keep only what you need. Data from PorchQ is about real neighbours. Don’t keep it longer than your feature needs, and don’t use it for anything the person didn’t ask for.
• Revoke on disconnect. When the person disconnects PorchQ in your app, call /oauth/revoke.

Reporting a problem

If you find a security problem in PorchQ’s MCP server or sign-in, please tell us through the contact page and don’t test it against other people’s data.