Security & Trust

Giving an AI agent access to your store is a trust decision. Here is exactly how Shopigent limits, records, and controls that access.

The access model

1. You choose the categories. Each of the 8 tool categories (Products, Orders, …) has an on/off toggle. Disabled categories are invisible to agents — the tools aren't listed, let alone callable.
2. Reads and writes are separated by plan. Free is read-only by design; write tools only exist on paid plans.
3. Destructive actions stop at the confirmation gate. Create, edit, delete, refund — the call pauses and a confirmation card appears in your dashboard. Nothing executes until a human approves it.
4. Everything is written to the audit log. Tool name, full input, result, latency, timestamp. The log is append-only.

API keys

• Keys are shown once at creation; Shopigent stores only a salted hash.
• Keys can be revoked instantly from the dashboard.
• Each key is scoped to one store.

Data handling

• Shopigent processes your store data to execute tool calls; it does not sell it or use it for advertising.
• Store data is not used to train AI models.
• Audit log entries are retained so you can review agent activity; you can request deletion of your data at any time.
• Uninstalling the app triggers Shopify's standard data-removal webhooks and Shopigent deletes stored shop data accordingly (see Privacy Policy).

Shopify-side protections

• Shopigent requests only the Shopify scopes needed for the categories you use.
• All traffic runs over TLS.
• Billing is handled entirely by Shopify — Shopigent never sees your payment details.

Reporting a vulnerability

Found something? Email shopigent@greeknous.com. We respond fast and appreciate responsible disclosure.