Ontop MCP Server Terms of Use — Pilot Release
Effective Date: September 23, 2026
These Terms of Use govern your access to and use of the Ontop Model Context Protocol (MCP) Server, which allows you to connect a third-party Artificial Intelligence (AI) environment to your Ontop account. Please read these Terms carefully, as they establish the data protection, security, and liability boundaries between your use of external AI providers and the Ontop platform.
Pilot release. The MCP Server is currently made available as a pilot. These Terms describe the MCP Server as it operates today. Several controls that form part of Ontop's longer-term design; including OAuth authorization, automatic Access Key expiry, self-service access to connection logs, and administrator-controlled suppression of worker identifiers, are in development and are not available in the Pilot. Section 9 lists them. Ontop expects to add capabilities during and after the Pilot. Each material change will be reflected in an updated version of these Terms and notified under Section 20. The Client should not rely on any capability that is not expressly described in these Terms as currently available.
By generating an Access Key for, connecting to, or otherwise accessing or using the Ontop MCP Server (the "MCP Server"), you agree to be bound by these Terms of Use (the "Terms"). If you access the MCP Server on behalf of a company or other legal entity (the "Client"), you confirm that you are authorized to bind that entity to these Terms.
These Terms are supplemental to, and do not replace, any master subscription agreement, Client Terms and Conditions, Privacy Policy, order form, data processing agreement, or equivalent agreement between the Client and Ontop Holdings Inc. or any of its affiliates ("Ontop", "we", "us") governing the Client's use of the Ontop platform (the "Main Agreement").
Order of precedence. In the event of a conflict:
The Client acknowledges that the MCP Server is a pilot offering, that its capabilities are limited to those described in these Terms, and that these Terms will be updated as those capabilities change.
Capitalized terms not defined here have the meaning given in the Main Agreement.
If you do not agree to these Terms, do not access or use the MCP Server.
The MCP Server lets an Authorized User connect an AI Environment of their choice to the Client's Ontop account and ask questions about the Client's own Account Data in natural language. Key characteristics of the MCP Server in the Pilot :
Ontop does not operate or control the Client's AI Environment and has no access to the Output generated within it. The Client is solely responsible for the selection, configuration, and use of its AI Environment and for any Output.
The characteristics described in this Section 3 are commitments by Ontop as to the design of the MCP Server, and are not subject to the disclaimer in Section 14.
The MCP Server is available only to Clients with an active Ontop account in good standing, and only where enabled by the Client's administrator. Access is provided for the Client's internal business use in connection with its own Ontop account.
Access control in the Pilot. The Client's administrator may revoke any Access Key at any time from the Ontop platform. Revoking an Access Key immediately ends all access that uses that key. Access control in the Pilot operates at the level of the Access Key: because a key may be placed by an Authorized User into any AI Environment, Ontop cannot block an individual Authorized User's use of a key that has not been revoked. The Client is responsible for issuing Access Keys only to Authorized Users it intends to permit, and for revoking a key when that permission ends.
Ontop may make the MCP Server available free of charge and may change, limit, or withdraw it at any time in accordance with these Terms and the Main Agreement. After the Pilot, except where a change is required to address a security, legal, or regulatory risk, Ontop will give the Client at least thirty (30) days' prior notice before withdrawing the MCP Server or removing a tool on which the Client's use materially depends.
Pilot terms. During the Pilot: (a) the MCP Server is provided free of charge; (b) Ontop may add, change, or remove tools and features on reasonable notice, which may be given through the Ontop platform; and (c) Ontop may invite the Client to share feedback on its use of the MCP Server, which the Client may decline. Ontop may introduce fees for the MCP Server after the Pilot by giving the Client at least thirty (30) days' prior notice, and fees will apply only if the Client continues to use the MCP Server after that notice period.
No service level. The MCP Server is provided without a service level commitment and is not covered by any availability, uptime, or support commitment in the Main Agreement unless the parties expressly agree otherwise in writing.
In the Pilot, the MCP Server supports one authentication method: an Access Key (an API key generated in the Ontop platform). OAuth authorization is not available; see Section 9.
6.1 Access logs
Ontop logs each request to the MCP Server, including the timestamp, the tool invoked, the Access Key to which it is attributed, and the response status. These logs are maintained by Ontop for the purposes set out in Section 11.3. Self-service access to MCP Server logs from the Ontop platform is not available in the Pilot; see Section 9.
6.2 Retention
Ontop retains MCP Server access logs for the longer of twelve (12) months and any period required by applicable law or regulation, including recordkeeping obligations applicable to Ontop as a registered money services business. Logs are used only for the purposes set out in Section 11.3 and are never used to train any artificial intelligence model.
6.3 Regulated clients
Ontop recognizes that clients that are, or that serve, regulated financial institutions may be subject to third-party and ICT risk management requirements. On reasonable request, Ontop will provide information reasonably necessary to support the Client's due diligence and ongoing monitoring of the MCP Server, including any security certifications Ontop then holds and a description of the MCP Server's architecture and data flows. During the Pilot, a Client that is subject to Regulation (EU) 2022/2554 (DORA), the interagency third-party risk management expectations applicable to US banking organizations, or comparable requirements must contact Ontop before enabling the MCP Server. Any supplemental terms will apply only if agreed in a written addendum to the Main Agreement.
Permitted use. The Client may use the MCP Server solely to read its own Account Data through an Eligible AI Environment for the Client's internal business purposes.
The Client shall not:
The AI Environment is a third-party system that the Client selects, enables, configures, and controls at its own discretion and risk (for example, Claude, ChatGPT, Perplexity, or another MCP-compatible client). The Client acknowledges that:
Given the sensitivity of payroll and financial Account Data, the Client may connect only an Eligible AI Environment. An AI Environment is an Eligible AI Environment only if, at all times while connected, it is governed by written terms between the Client and the AI Provider that:
The Client represents and warrants that each AI Environment it connects meets these conditions, and undertakes to disconnect promptly any AI Environment that ceases to meet them. Ontop may request written confirmation, and may revoke the relevant Access Key where the Client does not provide it within a reasonable period.
Supported AI Environments. MCP is an open protocol, and the MCP Server does not technically restrict which AI Environment may connect using a valid Access Key. Compliance with this Section 8.2 is therefore a contractual obligation of the Client, on which Ontop relies. Ontop may publish a list of AI Environments it has tested, but does not verify, approve, or block any AI Environment. Where the Client connects an AI Environment that is not an Eligible AI Environment, Ontop's remedies are those set out in Section 19, including revocation of the relevant Access Key.
The Client authorizes Ontop to return Account Data to the AI Environment activated by the Client's Access Key, and represents that it has all rights and authority necessary to grant that authorization, including in respect of Worker Data.
The MCP Server may be connected in different ways, and the following apply regardless of method:
The MCP Server is read-only, as described in Section 3. Nothing in these Terms grants the Client any right to write, modify, or transactional capability that is not expressly offered. Ontop does not intend to expose any tool that initiates, authorizes, or modifies the movement of funds.
The following are part of Ontop's design for the MCP Server but are not available in the Pilot. The Client must not rely on any of them:
The following is not planned, and the Client should not assume it: technical restriction of AI Environments. MCP is an open protocol and the MCP Server does not restrict which AI Environment may connect with a valid Access Key. See Section 8.2.
No capability listed in Section 9.2 may be relied on until these Terms state that it is available. Ontop may introduce additional capabilities, including tools that perform write actions. Before any write capability becomes available to the Client:
Ontop's processing of personal data in connection with the Client's account and use of the MCP Server is governed by the Main Agreement, any applicable data processing agreement, and Ontop's Privacy Policy at https://www.getontop.com/policy/privacy-policy.
Where Ontop processes personal data on the Client's behalf in connection with the MCP Server, Ontop acts as a processor acting on the Client's documented instructions, and the Client acts as the controller. The Client's act of connecting an AI Environment and submitting a question constitutes a documented instruction to Ontop to disclose the responsive Account Data to that AI Environment.
Ontop logs requests to the MCP Server (the tools invoked and their parameters, not the questions typed by Authorized Users or the Output) for security, abuse-prevention, and compliance purposes, and to operate, support, and improve the MCP Server, including through aggregated usage analytics. Such logs will be retained in accordance with Section 6.2, and will under no circumstances be used by Ontop to train any artificial intelligence model. Ontop does not access or review Output generated within the Client's AI Environment. Once Account Data is transmitted to the AI Environment on the Client's instruction, its further processing is governed by the Client's arrangements with the relevant AI Provider, as described in Section 8.
When an Authorized User asks a question, the MCP Server reads and returns categories of the Client's own Account Data, which are then transmitted to, and become accessible within, the AI Environment the Client has connected. These categories are:
This list reflects the tool responses in the Pilot and will be updated if the tool set changes.
Some of this data — in particular worker and contractor names, emails, countries, roles, remuneration, and payment details — is personal data of individuals who are not the person granting consent. By connecting an AI Environment and asking questions that return this data, the Client causes such third-party personal data to be transmitted to the AI Provider. The Client, acting as the data controller, is responsible for ensuring it has a lawful basis and appropriate arrangements in place to do so, including:
Ontop does not currently offer a setting that suppresses worker identifiers from tool responses. In the Pilot, the controls available to the Client are the credential, access, and use restrictions in these Terms, together with the arrangements the Client puts in place with its AI Provider. See Section 9.
Other than information the Client's users may have entered in free-text transaction descriptions (see Section 11.4), the MCP Server does not return signed documents or their contents, bank-account, card, or wallet numbers, tax or national identifiers, postal addresses, phone numbers, or dates of birth, and does not access any special categories of personal data (such as health, biometric, racial or ethnic origin, trade-union membership, or similar data). It cannot reach data belonging to any account other than the Client's own.
Ontop retains all intellectual property rights in the MCP Server, including its tools, interfaces, query definitions, schemas, and documentation. The Client is granted a limited, non-exclusive, non-transferable, revocable right to use the MCP Server solely as permitted in these Terms. All rights not expressly granted are reserved.
The Client retains all rights in its Account Data. As between Ontop and the Client, Output is the Client's, subject to the Client's arrangements with the AI Provider; Ontop makes no claim to it and assumes no responsibility for it. If the Client provides feedback or suggestions regarding the MCP Server, it grants Ontop a perpetual, irrevocable, royalty-free license to use that feedback without obligation.
Non-public information about the MCP Server, including its features, tool definitions, and documentation, is Ontop's confidential information. The Client shall protect it with at least reasonable care and shall not use or disclose it except as necessary to use the MCP Server under these Terms. This obligation does not apply to information that is or becomes public other than through the Client's breach, is independently developed, or is lawfully received from another source without restriction.
Account Data is the Client's confidential information and is subject to Ontop's confidentiality obligations under the Main Agreement. Nothing in these Terms reduces those obligations.
Except as expressly stated in Sections 3, 5.3, 6, and 11.3, THE MCP SERVER AND ALL ACCOUNT DATA MADE AVAILABLE THROUGH IT ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, ONTOP DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, AND NON-INFRINGEMENT. ONTOP DOES NOT WARRANT THAT THE MCP SERVER WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, OR THAT OUTPUT WILL BE ACCURATE OR FREE FROM ERRORS OR HALLUCINATIONS. NOTHING IN THIS SECTION LIMITS ANY WARRANTY GIVEN BY ONTOP UNDER THE MAIN AGREEMENT.
TO THE FULLEST EXTENT PERMITTED BY LAW, ONTOP SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, DATA, BUSINESS, OR GOODWILL, ARISING OUT OF OR RELATING TO THE MCP SERVER, INCLUDING ANY RELIANCE ON ACCOUNT DATA OR OUTPUT, ANY INACCURACY OR HALLUCINATION, OR ANY ACT OR OMISSION OF AN AI PROVIDER.
Ontop's total aggregate liability arising out of or relating to the MCP Server and these Terms is subject to, and counts against, the limitation of liability set out in the Main Agreement. These Terms do not create a separate or lower cap.
For the avoidance of doubt, and without limiting the preceding paragraph, Ontop is not liable for any data breach, unauthorized access, or misuse of Account Data occurring within the AI Environment or the AI Provider's infrastructure after the Account Data has been transmitted to the AI Environment on the Client's instruction.
Nothing in these Terms limits or excludes liability for fraud or fraudulent misrepresentation, for death or personal injury caused by negligence, for a party's gross negligence or willful misconduct, or any other liability that cannot be limited or excluded under applicable law.
The Client shall defend, indemnify, and hold harmless Ontop and its affiliates and their respective officers, employees, and agents from and against any third-party claims, losses, damages, costs, and expenses (including reasonable legal fees) arising from: (a) the Client's use of the MCP Server in breach of these Terms; (b) the Client's selection, configuration, or use of any AI Environment, including any data breach, privacy violation, or unauthorized processing of personal data occurring within such AI Environment; or (c) the Client's violation of applicable law; in each case except to the extent the claim arises from Ontop's breach of these Terms, negligence, or willful misconduct.
Procedure. The party seeking indemnification will give the indemnifying party prompt written notice of the claim, sole control of the defense and settlement (provided that no settlement imposing a non-indemnified obligation or an admission of liability may be made without the indemnified party's consent, not to be unreasonably withheld), and reasonable cooperation at the indemnifying party's expense. A delay in notice relieves the indemnifying party only to the extent it is prejudiced by the delay.
Ontop's indemnities. Any indemnity given by Ontop under the Main Agreement, including in respect of third-party intellectual property claims, applies to the MCP Server as part of the Ontop platform.
The Client may make factual references to Ontop and the Ontop MCP Server when describing its use of them. The Client shall not use Ontop's name, logo, or trademarks in any way that implies endorsement, certification, or approval by Ontop without Ontop's prior written consent.
The Client shall comply with all applicable export control and economic sanctions laws, including those administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), and confirms that it is not located in, and is not a national or resident of, any jurisdiction subject to applicable comprehensive sanctions or embargoes. Use of the MCP Server from or in connection with such jurisdictions is prohibited.
The Client shall not permit any Authorized User who is a sanctioned person, or who is located in a comprehensively sanctioned jurisdiction, to access the MCP Server, and shall not connect an AI Environment operated from such a jurisdiction. Ontop may block, suspend, or terminate access where it determines, acting reasonably, that continued access would present a sanctions risk.
Ontop may suspend or terminate access to the MCP Server at any time, with or without notice, including for breach of these Terms, suspected compromise of an Access Key, connection of an AI Environment that is not an Eligible AI Environment, risk to Ontop's systems or other clients, or any reasonable suspicion of a data privacy violation or unauthorized processing of personal data by the Client or its AI Provider. Where Ontop suspends access without prior notice, it will notify the Client promptly afterwards and, where the cause is capable of remedy, will restore access once the Client has remedied it.
Access to the MCP Server terminates automatically if the Main Agreement terminates or expires. Ontop may modify or discontinue the MCP Server or any of its tools at any time, subject to Section 4.
On termination or suspension, the Client must cease use of the MCP Server and revoke its Access Keys . Account Data already retrieved by an AI Environment is not recoverable by Ontop; the Client is responsible for its deletion under the Client's arrangements with the AI Provider.
Sections 7, 10 through 18, and 20 through 22, and this Section, survive termination.
Ontop may update these Terms. The current version will be available at link. Where a change is material, Ontop will give the Client at least thirty (30) days' prior notice before it takes effect, except where a shorter period is required to address a legal, regulatory, or security requirement. If the Client does not accept a material change, its remedy is to stop using the MCP Server before the change takes effect. Continued use of the MCP Server after an update takes effect constitutes acceptance of the updated Terms.
These Terms are governed by the laws and subject to the exclusive jurisdiction of the courts as set forth in the Ontop Client General Terms and Conditions (available at https://www.getontop.com/policy/client-general-terms-and-conditions or the applicable customized master agreement executed between the Client and Ontop. Ontop may seek injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property or the security of its systems.
