Security & Trust

Giving an AI agent access to your store is a trust decision. Here is exactly how Shopigent limits, records, and controls that access.

The access model

1. You choose the categories. Each of the nine merchant-tool categories has an on/off switch on Scopes & Permissions. Turning an area off stops tools in that area from running. An enabled tool can still appear in the MCP tool list. The call does not read or change store data for that area.
2. Reads and writes are separated by plan. Free can run reads and can dry-run a write. The dry-run is not executed. Running a write requires Growth or Pro.
3. Confirmation-gated actions stop before execution. When the tool's confirmation setting is on, or the action always pauses (sales-channel publishing, variant shipping weight, media upload, theme pull request creation), the tool returns a signed, single-use confirmation_pending result. You approve in your AI client and the agent re-calls the tool with the confirmation token bound to the same arguments. You can also approve or decline that pending token on the Confirmations page. Approve uses the same check as the client re-call. Decline uses the token and does not run the tool. The page does not show the token.
4. Tool calls are recorded. The audit log stores the tool name, input, result, latency, and timestamp. View stored details shows a redacted copy. The view redacts secret- and token-like fields, names, addresses, and email- or phone-shaped values. Opening it does not change the database row. customers/redact can later redact matching stored payloads. The log is not append-only.

API keys

• Keys are shown once at creation. Shopigent stores a SHA-256 hash of the key. The hash is not salted.
• Regenerate connection key replaces that hash, and the previous key is rejected. Uninstall clears the hash. There is no separate revoke control that leaves the old key in place.
• Each key is scoped to one store.

Data handling

• Shopigent processes your store data to execute tool calls; it does not sell it or use it for advertising.
• Store data is not used to train AI models.
• Audit log entries are retained so you can review agent activity; you can request deletion of your data at any time.
• Uninstalling the app deletes session rows and clears the MCP API key hash. It does not delete the shop row. shop/redact, about 48 hours later, deletes the shop row. customers/redact redacts matching audit payloads. See the Privacy Policy.

Shopify-side protections

• Shopigent requests only the Shopify scopes needed for the categories you use.
• All traffic runs over TLS.
• Billing is handled entirely by Shopify — Shopigent never sees your payment details.

Operational observability

Product media uploads emit structured JSON log entries (event: "media_upload_stage") at every pipeline stage: stagedUploadsCreate, confirmation_issued, binary_upload, fileCreate, file_status_polling, productSet, and final_readback.

Each entry carries:

• stage name and shop identifier
• operation ID (your idempotency key or a generated hash)
• product ID and file count
• on error: a sanitized diagnostic excerpt and Shopify request ID

The following are never included in any log entry:

• Shopify access tokens, client secrets, or session tokens
• HTTP headers or bearer tokens
• Confirmation token values
• Base64 file payloads or staged upload target parameters
• Signed URLs, X-Amz headers, or S3 credentials

See the Privacy Policy for data retention and deletion.

GitHub theme connections

• A new store cannot connect Theme Pull Requests through the GitHub App. The page does not start an install, and the /auth/github callback does not save a first installation. Connect with a repository-scoped personal access token. A shop that already has a stored installation can choose a repository that installation can access. If the GitHub App is not configured, the page says the one-click flow is not set up and the token form remains.
• A personal access token is encrypted at rest (AES-256-GCM) before it is stored and is never returned by any API or shown again.
• Shopigent reads only explicitly requested repository files. A dry-run returns a preview and does not open a pull request. A live call requires confirmation, then it can create a branch, commits, and a pull request containing the declared changes.
• Shopigent never merges, deploys, publishes, or directly edits Shopify theme code through the Admin Theme API, and it does not request direct Shopify theme scopes.
• You review and merge the PR. Shopify's native GitHub theme integration then synchronizes the connected branch to the theme you selected. Use an unpublished connected theme for review so the live storefront remains unchanged; publication is always merchant-controlled.

Reporting a vulnerability

Found something? Email shopigent@greeknous.com. We respond fast and appreciate responsible disclosure.