Your infrastructure.
Your approval path.
The connector is an MCP server in your repo and cloud account. I work against your sandbox and test tenant. I never hold production credentials.
OAuth · HTTPS→Your API
User's token
Where it runs
You own the domain, secrets store, queue and database. You choose the region. Results return to the client; held writes and audit records stay in your store. Nothing of Holdwater's sits in the path after handoff.
The connector calls no language model. The eval does, in your CI, on your key, using synthetic cases.
Access and data
You issue and revoke sandbox credentials. I keep them in a password manager with MFA and revoke access at handoff. Your users sign in with OAuth; the connector never sees their passwords.
Only code is copied to my machine. Prefer synthetic test data. Declare any personal data in the test tenant before access; we agree the minimum access in writing. Any permitted working copies are deleted within 30 days of acceptance, confirmed in writing.
Writes and failure
Every write waits in your queue for a user's approval. Destructive writes are marked and ask twice. Idempotency keys prevent duplicate effects. Holds expire after the agreed period. Your engineer controls an off switch for each tool.
On failure, the connector returns a safe error and keeps writes held. I reply within two business hours on weekdays. Fixes are planned that evening; longer fixes get a written date. An incident note follows within 24 hours of my learning of it.
The audit record
Time, tool, annotation, client session id, redacted arguments, result status, upstream status, latency, hold id, approver, approval time and replay id. No secrets. You set retention and redaction; export JSON lines by date range.
The code uses the official MCP SDK and pinned dependencies. The eval runs on every push. Your named engineer reviews the write path with me before acceptance.
I am Affan Yasir, a sole proprietor in Toronto. I do not claim SOC 2 or a third-party penetration test. Any insurance and liability terms must be confirmed in the signed agreement.
The public Teller demo is separate, uses simulated records and never touches yours.