Security
Security for your clients' data, their LinkedIn accounts and your AI assistants.
How LinkedCamp protects client data and LinkedIn accounts: encryption, GDPR and DPA, dedicated IPs, and how AI assistants are permissioned over MCP.
Client isolation
How does LinkedCamp keep one client's data away from another's?
Each client is a separate sub-account with its own campaigns, inbox, mailboxes, dedicated IP and API key. Only the agency owner key can reach a sub-account, and only those inside your own agency. The MCP server checks every sub-account id against your roster and refuses anything else, so a prompt can't reach another agency's or client's data.
AI & MCP access controls
Is it safe to connect LinkedIn automation to ChatGPT or Claude?
Yes, with the right controls. LinkedCamp's MCP server authenticates with OAuth 2.1 and PKCE or your API key, sees only what your user permissions allow, and labels every tool as read-only, write or destructive. Writes run when you ask, within your permissions; the destructive ones (launches, sends, publishes, deletes) ask first. Agents can't see other sub-accounts unless an owner key is used.
Sending a message is a destructive tool: your assistant must ask, and you must confirm, every time.
AI & MCP access controls
133 tools| Control | How it works |
|---|---|
| Authentication | OAuth 2.1 + PKCE (API key) or X-Api-Key/Bearer header |
| Permissions | Tools hidden if your section permissions deny them |
| Tool annotations | 133 tools: 64 read-only and 69 that change data, 28 of them destructive (they ask first) |
| Sub-accounts | Owner key required; only listed tools accept userId |
Architecture
Security architecture at a glance
Encryption in transit
TLS 1.2+ required on every request to our dashboard, API, and webhooks. No plaintext HTTP anywhere.
Encryption at rest
Primary data stores are encrypted at rest. Secrets (API keys, LinkedIn session cookies) are encrypted.
Dedicated IP per account
Country-based dedicated IP on every LinkedCamp plan. No IP sharing across customers, so your account safety is tied only to your own behavior.
Least-privilege employee access
No LinkedCamp engineer can read your LinkedIn credentials or message content without your explicit support-ticket authorization. All production access is logged and audited.
GDPR + CCPA aligned
Every processing activity has a documented legal basis (contract, legitimate interest, or consent). Data subject requests go to support@linkedcamp.com, with a 30-day response.
Scoped AI access
The MCP server acts with your API key's permissions. Destructive tools ask first; billing, team roles and stored credentials aren't exposed to the assistant.
Backups + disaster recovery
Daily encrypted backups, point-in-time recovery for the primary database, and geographic redundancy.
Privacy
Is LinkedCamp GDPR compliant?
LinkedCamp processes personal data under GDPR Article 6 legal bases and offers a standard Data Processing Agreement on request from support@linkedcamp.com. Data subjects can request access, correction, deletion or portability, and requests are answered within 30 days.
Compliance
How do I run a vendor security review of LinkedCamp?
Email support@linkedcamp.com with your security questionnaire and, if you need one, a request for the standard Data Processing Agreement. LinkedCamp answers the questionnaire directly and sends the DPA for signature, so procurement and legal teams can complete the review without a call.
Compliance posture
- GDPR
- Aligned. DPA on request. 30-day response to data subject requests.
- CCPA
- Aligned. California residents have full access and deletion rights via support@linkedcamp.com.
- HIPAA
- Not covered. LinkedCamp is not positioned for Protected Health Information.
- PCI DSS
- Out of scope. LinkedCamp never stores cardholder data; Stripe handles all payment processing.
FAQ
Security questions
Open any question for the answer.
Can my client see my other clients?
Do you have a Data Processing Agreement (DPA)?
How is my data encrypted?
Where is my data stored?
How long do you retain my data?
How do you handle my LinkedIn credentials?
How does the dedicated IP architecture keep my account safe?
Need a security review?
If your team needs a security questionnaire filled out, a DPA or a vendor risk-assessment call, email support@linkedcamp.com.
Run client outreach with the guardrails on.
Start a 14-day free trial. Every client account gets its own dedicated IP, and your assistant asks before it launches, sends, publishes or deletes anything.