# Security & limits

> How the MCP server protects your data, and the rate limits that apply.

Source: https://docs.formclick.io/mcp/mcp-security

## Your data

- Submission contents are returned as **untrusted data**. Assistants are told never to follow instructions found inside submissions, which protects against prompt injection from form spam.
- Long values are shortened, and password- and card-like fields are redacted.
- Nothing from submissions or tool arguments is written to logs.
- Webhook and redirect URLs must point to public internet addresses.

## Rate limits

| Limit | Value |
| --- | --- |
| Requests | 60 per minute, per user and app |
| Write tool calls | 20 per minute, per user and app |

## Good practice

- Grant **read-only** access unless the assistant needs to create or change forms.
- Review write tool calls before approving them in your client.
- Revoke apps you no longer use in **Settings → API & MCP**.