English Français العربية

io.github.mydatapass/mydatapass

السجل الرسمي أخرى

Neutral escrow for customer-data offboarding (GDPR/EU Data Act): query MyDataPass facts.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http mydatapass 'https://mcp.mydatapass.app/api/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "mydatapass": {
            "type": "http",
            "url": "https://mcp.mydatapass.app/api/mcp"
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. mydatapass-verify
  2. Why this repo exists
  3. Transparency log: retention and closure commitment
  4. What's in an export package
  5. Verify an export
  6. What this repo is NOT
  7. License

mydatapass-verify

Independently verify a MyDataPass export — without trusting us.

MyDataPass delivers customer data offboarding exports as encrypted, audit-logged packages. This repository contains everything a recipient (or their security team) needs to decrypt and verify an export with zero MyDataPass involvement: the package format specification and two standalone verifiers.

Why this repo exists

Our security model does not rely on secrecy of the format — it relies on the strength of the passphrase and standard, auditable cryptography. Publishing the format and the verification tooling means:

  • Your security team can review exactly how packages are encrypted before signing anything.
  • Recipients can decrypt and verify integrity offline, with no MyDataPass servers involved.
  • If MyDataPass disappeared tomorrow, every delivered package would remain fully recoverable with the passphrase and this tooling.

Transparency log: retention and closure commitment

Every signed certificate's SHA-256 fingerprint is appended to the public transparency log at mydatapass.app/transparency. The log holds hashes only, no customer data.

  • Retention: each log entry is kept for at least 5 years from the date it was added, and for as long as MyDataPass operates.
  • If MyDataPass ceases operations: we will publish a final copy of the complete log in a public archive (this repository, or a public archive linked from it), so every certificate remains checkable against the log without us.

The full certificate record (with the names of the parties) is kept for a fixed period per service and then reduced to its hash; the periods are in our Terms (§ 8) and DPA (Annex 1). A signed certificate stays verifiable offline with its signature, qualified time stamp and anchor, so keep your own copy.

What's in an export package

A MyDataPass package is a JSON file with four fields:

FieldDescription
ciphertext_b64AES-256-GCM ciphertext, Base64
iv_b6412-byte random nonce, Base64
salt_b6416-byte random KDF salt, Base64
hash_sha256SHA-256 hex digest of the original plaintext

Encryption: AES-256-GCM. Key derivation: PBKDF2-HMAC-SHA256, 310,000 iterations, 32-byte key. Full details in docs/export-format.md.

Verify an export

Option A — browser, fully offline

Open verify.html in any modern browser (works from file://, no network requests are made). Select the package file, enter the passphrase, and the page decrypts via WebCrypto and checks the SHA-256 digest locally.

Option B — command line

Requires Python 3.9+ and the cryptography package:

pip install cryptography
python verify.py package.json --out exported-data.bin

The script prompts for the passphrase, decrypts, and confirms the plaintext digest matches hash_sha256. Exit code 0 means the package is authentic and intact; any tampering with the ciphertext fails GCM authentication.

What this repo is NOT

This is not the MyDataPass product source code. It is the public, auditable surface: the delivery format, the verification tooling, and our security model. Questions or responsible disclosure: silvia@mydatapass.pro.

License

MIT — see LICENSE.

الأسئلة الشائعة

ما هو io.github.mydatapass/mydatapass؟

Neutral escrow for customer-data offboarding (GDPR/EU Data Act): query MyDataPass facts.

كيف أثبّت io.github.mydatapass/mydatapass؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http mydatapass 'https://mcp.mydatapass.app/api/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج io.github.mydatapass/mydatapass إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل io.github.mydatapass/mydatapass مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون io.github.mydatapass/mydatapass؟

ينشره mydatapass. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.