Built to pass a security review.
MCT is a translation and assembly layer. It reads and writes content, and it is deliberately blind to everything else in your org.
The short version for your reviewer.
OAuth 2.0 client-credentials
The backend authenticates to Marketing Cloud with a server-to-server API integration. No user passwords, no session sharing, no stored end-user tokens.
Least-privilege scopes
Saved Content read and write only. MCT cannot read Data Extensions, send email, manage journeys, or touch subscriber records because those scopes are never granted.
Secrets in a managed vault
Client ID and client secret live in Azure Key Vault or the equivalent secret store for your host. They are never placed in the block configuration, in Content Builder, or in source control.
Tokens are short-lived
Access tokens are requested per operation window and held in memory only. Rotating the API integration in Marketing Cloud immediately cuts off the backend.
Exactly what crosses which boundary.
Four hops, and only one of them leaves your infrastructure.
- 01
Block UI (inside Marketing Cloud)
The custom content block runs in an iframe inside Content Builder and talks to the backend over HTTPS. It carries your copy and configuration, nothing else.
- 02
MCT backend (your infrastructure)
Stashes AMPscript and personalization tokens, chunks the remaining copy, calls Google Cloud Translation v2, re-injects the stashed code, and assembles the result.
- 03
SFMC REST API (write-back)
Per-language content blocks and the switch email are written back into your own Content Builder using the least-privilege API integration.
- 04
Send time (MCT is not in the path)
Marketing Cloud renders the switch email itself. If the MCT backend is offline, your sends are unaffected.
Leaves your infrastructure
Only the marketing copy in the block, split into chunks, sent to Google Cloud Translation v2 over TLS. AMPscript, personalization tokens and do-not-translate terms are stashed out before the call and never transmitted.
Stays inside your boundary
Your Marketing Cloud org, your subscribers, your send infrastructure, and the MCT backend itself, which you deploy and control.
It runs where you say it runs.
There is no shared multi-tenant MCT cloud processing your copy unless you choose a hosted deployment.
Azure App Service
Default deployment. Your subscription, your region, your network rules, secrets in Azure Key Vault.
Marketing Cloud CloudPages
SSJS deployment that keeps the backend inside Marketing Cloud itself, for orgs that will not stand up external infrastructure.
PHP host
Any standard PHP host, for teams with existing hosting they prefer to reuse. Same block, same compile behavior.
One deployment can serve multiple orgs through path-based routing, with separate credentials per org in the secret store. Orgs never share configuration or output.
What MCT never touches.
Operational controls.
In transit
All traffic between the block, the backend, Google Cloud Translation and the SFMC REST API is HTTPS with TLS 1.2 or higher.
At rest
Compile output lives in your Content Builder. The backend keeps no copy of your emails beyond the duration of a compile request.
Secrets
Managed secret store only, with rotation supported at any time by reissuing the API integration and updating the vault entry.
Logging
Operational logs record request timing, status and error codes. They are scoped to your deployment and you control retention through your host's log settings.
Found something? Tell us directly.
Email security@genetrix.tech with steps to reproduce. We acknowledge reports within one business day and will keep you updated until the issue is closed. Please do not test against another customer's org.
For a suspected incident affecting your deployment, use the same address with "INCIDENT" in the subject line and include your org ID.
This page is not a certification
It is maintained by Genetrix and describes the controls that ship with MCT today. We do not currently claim SOC 2, ISO 27001, HIPAA or PCI compliance, and we will not imply otherwise on a sales call. Because MCT runs on infrastructure you own, your own hosting, network and access controls form part of the overall posture. If your procurement process needs a completed questionnaire, we will fill in yours.
Send this page to your security team.
Then book 30 minutes with us to walk through anything it does not answer.
