Is It Safe to Connect an AI Agent to Your Store? Access, Passwords and a Security Checklist

Connecting an AI agent to your store is safe when you control three things: what it can reach, what it can do without asking, and what record it leaves. It becomes risky when an agent gets broad access, shared passwords and no trail, because then nobody can say what it did or stop it doing more.

This guide explains how agents get into your systems, the risks that matter for an online store, a checklist you can use with any vendor, and the questions to ask in writing before you connect. It ends with how Concierge handles each point.

• Too much access: An agent that only answers order questions doesn't need to publish theme changes or edit discounts. Every extra permission is something that can go wrong.
• Actions you can't undo: Refunds, cancellations and deleted data. A person should ask for these or approve them.
• Talking to the wrong customer: Sharing order details with someone who only knows an email address or order number.
• Passwords in chat: A password typed into a conversation can end up in logs, transcripts and exports.
• Leftovers: Files, sessions and data that stay on a machine after the job, where the next job can reach them.
• Instructions hidden in content: An email, web page or file the agent reads can contain text written to steer it, known as prompt injection. Limits on what an agent can do reduce how much harm a bad instruction can cause, but they don't replace the vendor's own defenses, so ask about those.
• No trail: If you can't see what the agent did and why, you can't fix mistakes or prove what happened.

• Each agent has only the permissions its job needs.
• Each agent answers only the channels you assign it.
• Changes the agent decides on by itself wait for a yes.
• Refunds are approved by your team.
• Customers prove who they are before the agent shares private details or changes their account.
• Nobody types a password into a chat. A person signs in to websites themselves.
• Work that needs code or files runs on an isolated machine that is wiped after the job.
• Every request, approval, action and reply is recorded and easy to review.
• What the agent remembers can't identify a customer, and you can make it forget.
• Tool connections can be revoked with one click, and leave when a teammate leaves.
• Recordings and data are deleted on a schedule you set.
• You tested the agent away from live customers before turning it on.
• You know who on your team can change agents and channels.

Ask these in writing, and keep the answers. A vendor that can't answer clearly is telling you something.

• Certifications: Which security audits do you hold, such as SOC 2 Type II, and can we see the report under NDA?
• Sign-in for our team: Do you support single sign-on (SSO) with SAML?
• Model providers: Which AI model providers process our data, and do any of them train on it?
• Prompt injection: What stops instructions hidden in an email, web page or file from steering the agent?
• Access: Can we limit each agent to specific actions? Which actions always need approval?
• Passwords: How does the agent sign in to websites, and where are credentials stored?
• Isolation: Where does the agent run code or open files, and what happens to that machine afterwards?
• Records: What is logged, who can see it, and for how long?
• Deletion: How do we delete recordings, memories and customer data, and how do you handle data erasure requests?
• Sub-processors: Which third parties process our data, and where?

Ask every vendor the same list, including us. Answers to the model-provider and prompt-injection questions belong in writing from the vendor, not in a blog post, because they depend on contracts and change over time.

Chargezen is SOC 2 Type II certified and supports single sign-on (SSO) with SAML 2.0; see the Trust Center and security page. Inside Concierge, these controls are in the product today (details in security for agents):

• Access per agent: On each agent's Configure Agent page, you tick only what it may look up or do, and the channels it answers. An agent without a capability can't use it, however it's asked.
• Customers prove who they are: Before an agent shares private order or account details, or changes a customer's account, the customer confirms a sign-in code.
• Its own ideas wait for a yes: Changes someone explicitly asks for run without a separate approval. Anything the agent proposes on its own asks first, as an offer. In a scheduled task, where nobody is present, a step that could do damage needs a teammate's standing permission or approval. Agents open returns; refunds stay with your team.
• A private computer per job: When a job needs code, spreadsheets or files, the agent gets its own computer, closed off from your other systems. It is shut down when the work is done, and the next job starts on a fresh one.
• Sign-ins stay with you: When a website needs a login, the agent hands you the screen to sign in yourself. Your password never goes into the chat.
• A record of every step: Every request, approval, tool use and reply is saved in the conversation and in Operate > History.
• Memory that respects privacy: Agents learn how your business works, never who your customers are. Each memory has an audience, and Forget erases one for good.
• Checked connections: ChatGPT, Claude and other assistants sign in with OAuth, act as the teammate who connected them, and lose access when you disconnect or remove that teammate. Slack requests are signature-checked.
• Retention: Call recordings are kept for the number of days you set (1 to 3,650), then deleted automatically, unless you place one on legal hold. Shopify customer data erasure requests are processed.
• Separate permissions for your team: Viewing Concierge, managing conversations and agents, changing channel settings and managing recordings are separate permissions.

• Create one agent with one job and the fewest capabilities that job needs.
• Test it in the Playground with real questions before it meets customers.
• Set your call recording policy before turning on voice.
• Decide who on your team can manage agents and channels.
• Review the conversation history every day of the first week.

Concierge gives your store digital employees with the controls above built in: approvals, a private computer per job, a browser that hands sign-ins to you and privacy controls. Concierge Starter is $20 a month with 20,000 credits. Pro is $199 a month, or $1,990 a year, with 199,000 credits. More credits cost $1 per 1,000, phone and text charges are billed as used, and there are no per-seat fees. See pricing.

Glossary: least-privilege access, credential handover, agent sandbox, OAuth, shadow AI, AI guardrails, audit trail, computer use and browser agent. Read next: how to keep a human in the loop, rolling out an AI support agent in four stages and can a general AI agent run your Shopify support?

Yes, when each agent has only the access its job needs, its own ideas wait for a yes, refunds stay with your team, and every step is recorded. Avoid tools that need your admin password.

No. Prefer built-in connections and OAuth. When an agent must use a website that needs a login, a person should sign in. In Concierge, the agent hands you the screen and your password never goes into the chat.

Yes. Chargezen is SOC 2 Type II certified and supports single sign-on with SAML 2.0. See the Trust Center for details.

Prompt injection is text hidden in an email, web page or file that tries to steer an AI agent into doing something you didn't ask for. Ask each vendor in writing how they defend against it, and limit what each agent can do.