Security

Security

The security behind your AI agent.

Built so sensitive actions wait for your approval, your files stay in your own storage, and your business data stays yours.

What Connect does. What Connect does not.

Does

  • Waits for approval before irreversible actions — orders are held for review, not finalized automatically.
  • Saves your files to your own connected Google Drive, organized automatically by project.
  • Authenticates through your real accounts (Gmail, Drive, POS) rather than a separate master password.
  • Shows its work — referencing what data was pulled and from where, so you can verify before relying on it.

Does not

  • Share your data across customers — your business data is never visible to other retailers.
  • Finalize orders or payments on its own — purchases are staged for your review first.
  • Store your account passwords directly.
  • Use your data to train AI models for other customers.

Credentials & integrations

Your files live in your storage

Everything Connect creates — reports, spreadsheets, fliers — saves directly into your own Google Drive. If you disconnect Connect, your files stay exactly where they are.

Account-based authentication

Integrations connect through your existing Gmail, Drive, and POS accounts rather than a password Connect stores separately.

You control what’s connected

Disconnect any integration at any time from your account settings — access stops immediately.

Scoped access

Access can be limited per integration so Connect only sees what’s needed for the features you actually use.

Data handling

We don’t sell your data

Your business data is never sold, and never shared with other retailers, data brokers, or advertisers.

Your data isn’t used to train other customers’ models

Your business data stays specific to your account — it’s not used to train or improve the AI experience for other customers.

Compliance

Note: this section is intentionally left honest rather than filled with badges. List a certification here (SOC 2, GDPR, CCPA, state cannabis data regulations) only once it’s actually true — an accurate “we haven’t pursued formal certifications yet, here’s how we protect your data” reads as more trustworthy than an unearned badge, and an inaccurate one is a real legal risk.

Responsible disclosure

Found a security issue?

We’d rather hear about it from you than anyone else.

Report an issue

Security FAQ