Security & Compliance · Borneo + Claude
Borneo MCP with Claude: Find and Fix Sensitive Data Risks Faster
The short answer
Claude works with Borneo through the Model Context Protocol (MCP), an open standard that lets Claude securely use other software. Once connected with an API key or OAuth sign-in, Claude can help teams find sensitive data, assess privacy risks, start remediation workflows and check compliance, all through natural language requests with permissions the organisation controls.
What is Borneo?
Borneo is a data security and privacy platform used to discover sensitive information and reduce the risk it creates. It scans an organisation's infrastructure to locate personal and confidential data, then helps teams protect it. Security, privacy, compliance and IT teams typically use it to understand where sensitive data lives and to act on the risks they find, without relying only on manual reviews.
How Claude connects to Borneo through MCP
The Model Context Protocol (MCP) is an open standard that works like a universal adapter between Claude and other software. It lets Claude read information from a tool and take actions in it, using access that the organisation sets and can withdraw at any time. Borneo provides its own MCP server, and a direct API is also available, so Claude can reach the platform through a route that suits the organisation's setup.
Once connected, Claude can typically ask Borneo about discovered sensitive data, review the privacy risks it has identified and summarise the results in plain English. A privacy lead could ask for the highest-risk findings from the past week, and Claude would retrieve and explain them. Claude can also help prepare the next step, such as starting a remediation workflow.
Permissions and approvals keep people in charge. Access is limited to what each role needs, and consequential actions, such as changing or remediating data, can be set to require a named person's approval before they run. Every request Claude makes is logged, so the security team can review what was accessed and why.
What you can automate
Weekly sensitive data sweep
A privacy officer asks Claude each Monday for a summary of newly discovered sensitive data across cloud and on-premise sources. Claude pulls the findings from Borneo, groups them by data type and business unit, and highlights anything that has appeared since the last review. The officer spends minutes reviewing rather than hours compiling reports.
Privacy risk triage
When a new scan flags several risks at once, Claude helps the security team rank them by severity and likely impact. It explains each finding in everyday language, so non-specialist managers understand why an issue matters. Teams can then focus their time on the risks that deserve immediate attention.
Remediation request preparation
For a confirmed risk, such as personal data stored in an unprotected location, Claude can draft the remediation request and set out the steps required. The request goes to the data owner for approval before any change is made. This keeps fixes consistent and documented.
Compliance evidence gathering
Before an internal audit, a compliance manager asks Claude to collect evidence of how sensitive data has been identified and handled over a period. Claude retrieves the relevant records from Borneo and arranges them by control area. This shortens the time spent preparing documents for auditors.
Executive risk briefings
A chief information security officer needs a short update for the leadership team. Claude turns the latest Borneo results into a brief covering the main risks, trends and actions under way. The briefing is accurate to the source data and written for a non-technical audience.
An end-to-end workflow: Customer data risk review with Microsoft 365 and ticketing
TriggerBorneo flags a new location containing personal customer data, such as a shared folder with unrestricted access.
Claude retrieves the finding from Borneo and assesses the type and volume of personal data involved.
Claude checks the owning department and the access list in Microsoft 365 to identify who can see the data.
Claude drafts a summary of the risk and a proposed fix, such as restricting access to named staff.
A ticket is opened in the organisation's ticketing system and assigned to the data owner.
The data owner approves or amends the proposed fix, and the approved change is recorded in the audit log.
Claude confirms in a follow-up scan that the risk has been resolved.
OutcomeTypically, exposed personal data is identified and corrected within the same working day, with a clear record of who approved each change and why.
How we set it up
Free automation audit
We review your current data security and privacy workflows to find the processes where Claude and Borneo would save the most time and reduce the most risk.
Secure connection
We connect Claude to Borneo using the sign-in method your organisation chooses, either an API key or OAuth sign-in, with least-privilege access so Claude sees only what it needs.
Workflow design
We design the end-to-end process across Borneo and your other systems, such as Microsoft 365 and ticketing, and agree which actions need human approval.
Testing against real cases
We test the workflow against past scans and real findings to confirm accuracy, then adjust the prompts, permissions and approval steps.
Launch and training
We launch with monitoring and audit logs in place, and train your security, privacy and compliance teams to use the workflow confidently.
Who benefits
- Chief information security officer
- Gets clear, plain-language summaries of sensitive data risk for leadership reporting.
- Privacy officer
- Reviews new findings quickly and keeps a documented trail of how each risk was handled.
- Compliance manager
- Gathers audit evidence faster and with less manual effort.
- IT operations lead
- Starts remediation requests without leaving existing ticketing and collaboration tools.
Security and control
- Least-privilege access, so Claude can only read and act within the scope set for each role.
- Named human approval for any consequential change to data or access.
- Complete audit logs of every request and action taken through the connection.
- Credentials stored securely and rotated on a schedule your IT team controls.
- Regular review of the workflow against real cases before and after launch.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can align the workflow with their existing privacy and security obligations, including state privacy laws and UK GDPR. In India, the design can support obligations under the Digital Personal Data Protection Act, 2023. For organisations in the UAE and Saudi Arabia, the workflow can be built around local data protection laws. Claude can be hosted in India, the United States, the United Kingdom or the European Union, and the hosting region is chosen to meet your specific requirements.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the Borneo MCP server do?
The Borneo MCP server gives Claude a secure way to work with the platform. Through it, Claude can typically ask about discovered sensitive data, review privacy risks and help start remediation workflows. Access follows the permissions your organisation sets, and every request can be logged for review.
Is connecting Borneo to Claude secure?
The connection is designed around least-privilege access, so Claude only sees and does what each role requires. Sign-in uses an API key or OAuth sign-in, and consequential actions can require a named person's approval. Audit logs record activity, which supports your existing security controls.
What can Claude do with Borneo once connected?
Claude can typically retrieve sensitive data findings, explain privacy risks in plain English, summarise trends for leadership and prepare remediation requests. It can also gather records for compliance reviews. Final decisions and approvals stay with your team.
How long does setup take?
Timing depends on how many systems are involved and how complex your approval process is. A focused connection and workflow is often set up in a few weeks, including testing against real cases and team training. We confirm a realistic timeline during the free audit.
What plan or permissions do I need?
You need access to Borneo through an API key or OAuth sign-in, with permissions appropriate to the work Claude will do. Requirements vary by organisation, so we review your current access during the free audit and recommend the least-privilege setup that meets your needs.