Finimize MCP Manager Case Study

---

GDPR Compliance in the Age of AI:
How Finimize Stops MCPs from Sending PII

“MCP Manager allows us to filter out the data that we don’t want to ever hit AI. We can now connect the core tools that we use day-to-day with Claude, even if those tools have PII in them. Before, we couldn’t connect certain MCP servers at all.”

Matt Dalton,
CTO at Finimize

About Finimize’s AI Transformation

Finimize is the leading information platform for modern investors. Trusted by retail investors worldwide, Finimize boasts over a million daily readers across its web, app, and email channels.

Matt Dalton is the CTO at Finimize, where he leads engineering across the company and ensures that governance best practices and a strong security posture are upheld. He also decides which tools the business adopts, how customer data is handled inside them, and how both technical and non-technical employees can safely and confidently use the frontier AI tools available to them. 

His engineers are already deep in agentic workflows, such as skills, scheduled tasks, and MCP servers. Non-technical teams had started asking what Claude could do for them to save time and achieve more, if only it could reach the systems where the data and insights lived. 

The Challenge

Initially, Matt wasn’t able to give the greenlight to all the servers that teams wanted to use because some of these servers could also send PII to Claude.

Because MCP servers are a nascent technology for many organizations, most teams haven’t developed their own access control systems. Nonetheless, teams that take governance seriously must address how MCP gives unfettered access to both tools and data.

Without an ability to filter the data that MCP servers send to Claude, Matt didn’t have a way to enable teams to use AI in all of the ways that would allow them to save time. Without the ability to connect the servers they wanted to Claude, teams had to manually put together weekly reports or pull data for cross-team meetings that Claude could do faster. 

While seeking a solution, Matt realized that trying to build an MCP gateway would take precious time and focus away from delivering features and functionality for Finimize’s product. 

“We’d always rather spend our time building and maintaining our own product than putting together tools we could get elsewhere.”

The Requirements

The business units at Finimize that wanted to use MCPs, including sales, product, support and leadership, needed something they could easily connect to Claude with no local install and no configuration. 

Because all of these groups needed to connect Claude to servers that held PII, Matt also needed to ensure that admins at Finimize could configure MCP gateways that ensured no sensitive data would slip through. 

Under GDPR, users have a right to ask for their data to be deleted. Because Finimize had no way to guarantee they could delete data out of Claude once it arrived, they had to find a solution. Finimize decided that they had to strip personal data before it ever reaches AI via MCP, not after. The PII filtering had to be reliable and consistent, while the setup had to be easy for both engineers and non-technical knowledge workers. t in data, put in dates, and you’ll be able to visualize things. It is that simple. That’s what I really love about Visor.”

The Solution

Finimize found MCP Manager while looking for a central layer to control what data and tools flow between MCP servers and AI clients, like Claude. 

Matt started a seven-day trial where the MCP Manager team helped him create an AWS Bedrock guardrail that could catch emails, names, and phone numbers. AWS Bedrock Guardrails is one of several frontier guardrail systems that MCP Manager integrates with. 

It took less than 30 minutes for Matt to set up the AWS Bedrock guardrails, enforce it in MCP Manager, and verify the results in Claude. Matt confirmed through extensive testing that redaction of PII happens at the gateway, on every call, before anything reaches the model. 

“I tested MCP Manager’s gateway a fair amount and tried to get Claude to bypass the filters, and couldn’t.”

Once he verified that the guardrails worked, Matt rolled out MCP Manager with a simple Notion doc. Team members simply added the MCP connector link to Claude, pressed connect, and OAuth’d through. From there, the guardrails handled compliance for team members. Employees didn’t have to think about what they were sending to AI.

“MCP Manager kept our posture exactly the same as it was, while allowing us to use these tools. It’s just been getting out of the way of people doing their jobs, which is what I want.”
Results

The Results

Five teams at Finimize now query MCP servers to save time, without compromising Finimize’s commitment to user trust and its GDPR compliance status. 

Team members regularly generate dashboard views and assemble recurring weekly presentations in Claude Desktop, while engineers get the same governed access from Claude Code.

Before using an MCP gateway, four key MCP servers that teams wanted to use were off limits. Today, these servers are live across five teams. Meanwhile, Finimize’s compliance position is identical to what it was before enabling a full MCP rollout across the org. Nothing had to be explained to a customer, partner, or regulator because Finimize’s data-handling posture never changed. 

The trade-off many GDPR-bound companies think they have to make is either to connect useful systems via MCP (and take on new data-handling exposure) or block certain MCPs entirely (much to the chagrin of teams that want to use them). Filtering at the gateway introduces a third choice: connect all the MCPs you want, while limiting what those MCPs can actually send AI. 

Finimize’s answer was to govern AI access rather than restrict it. By providing easy-to-use MCP gateways with guardrails for GDPR, Matt was able to empower multiple teams to explore the edges of AI’s utility while still complying with regulations.