Published overview — 12 October 2026. This informational overview supports security due diligence. It does not replace an executed agreement, certify compliance or confirm every deployment's controls. Deployment-specific details must be confirmed in the applicable processing schedule before customer reliance.
Service and responsibility boundaries
RaptorMCP connects approved AI clients to customer-approved Qlik access. The security assessment must identify the Qlik platform, gateway deployment, portal services, AI provider and any enabled storage, reporting, automation or writeback service.
A hosted gateway and an enterprise gateway require separate hosting and operating schedules. The commercial portal is a separate service. For customers who choose Modern Management hosting, the hosted RaptorMCP gateway is hosted with OVH in France. Enterprise/customer-hosted gateway locations depend on the customer's deployment. Portal services, databases, logs, backups and onward processing locations should be identified separately in the applicable processing schedule.
POPIA and data protection
The Data Processing Addendum addresses POPIA and GDPR when Modern Management processes personal data on a customer's behalf. It describes documented instructions, confidentiality, security, assistance with data-subject requests, breach cooperation and return or deletion, subject to applicable retention.
The customer-specific schedule should identify responsible-party/controller and operator/processor roles for each workflow, data categories, purposes, instructions, locations and transfer arrangements. Portal account administration and processing customer Qlik data may have different roles. A reference to the DPA does not establish that a customer-specific operator agreement has been executed.
Query and AI data flows
The conceptual path is: user and approved AI client → RaptorMCP gateway → authorized Qlik service → permitted results returned through the gateway to the AI client. The actual deployment must establish which identity executes each step and which prompts, metadata, query results, rows, documents or generated artifacts cross each boundary.
Qlik source data remaining in Qlik does not mean that no data leaves Qlik. Returned results and metadata can enter the AI client's conversation and the selected provider's processing environment. Enabled portal AI, support summaries and other workflows require their own assessment.
Access, permissions and audit
The deployment review should verify gateway roles and enabled tools, authentication, credential handling, permitted Qlik spaces/streams/apps and applicable data reduction. Where a service identity is used, verify that returned results respect the requesting user's permitted scope. Read access, workflow approvals and authority to change Qlik or execute writeback must be assessed separately.
The Security and API Dependency Disclaimer and Raptor Support, Evidence and Audit Terms describe security and audit responsibilities. Actual enforcement, audit-event coverage, access to logs and review procedures require deployment evidence.
Hosting, encryption and stored information
A deployment schedule should confirm the provider and region for gateway, portal, database, logs, generated files and backups. It should record encryption on every connection, encryption of each storage layer, key and certificate ownership, credential protection and administrative access. A general security policy alone does not verify these settings.
The record inventory should distinguish transient query handling from persisted conversations, caches, reports, documents, workflow/writeback records, support evidence, operational logs and audit events. Enabled modules and provider settings determine the applicable inventory.
Retention, deletion and model training
The Global Privacy Policy describes typical retention of approximately 90 days for prompts/raw logs and up to seven years for audit trails. These statements require reconciliation with the applicable Raptor terms and an agreed schedule for the deployment; they are not confirmation that every record has those configured periods.
The schedule should cover expiry, return/deletion requests, backups, legal holds and deletion verification. AI-provider retention, conversation history and model-training use are separate from gateway storage. Confirm the named provider, product, account terms and settings before making a no-training or zero-retention statement. This overview provides no blanket no-storage or no-training assurance.
Incident response
The DPA provides for notification without undue delay after awareness of a personal data breach affecting the customer's data. Customer arrangements should identify incident contacts, escalation, investigation, containment, notification contents and updates. Any contractual notification period must be expressly agreed and supported operationally; this overview does not add a fixed-hour commitment.
Sub-processors and other providers
The Sub-processor and AI Provider List describes provider categories. The deployment schedule should name the applicable legal entities, processing purposes, regions and transfer arrangements, and distinguish providers engaged by Modern Management from services separately selected by the customer. A category list is not a complete named deployment inventory.
Certifications and assurance evidence
Modern Management/RaptorMCP is not independently certified and does not hold ISO 27001 certification or a SOC 2 report. A hosting or service provider's certification does not establish certification of Modern Management or RaptorMCP. Internal engineering reviews and control tests support technical assessment but do not constitute independent certification.
Request a deployment-specific review
Contact [email protected] for the applicable DPA, deployment and processing schedule, named provider information and available assurance evidence. Identify whether the intended service is hosted or enterprise/customer-hosted, the Qlik platform and the approved AI client/provider. Do not send credentials or raw confidential datasets in the initial request.