Security
Built so that connecting an AI to your store's numbers is a small risk, not a leap of faith.
You keep your AI login
ProfitNod never asks for, sees or stores your Claude, ChatGPT or Cursor login. Your AI connects to ProfitNod, not the other way round.
Connection links are shown once
A connection link is a key. It is shown one time, then stored only as a one-way hash, so nobody, including us, can read it back. Remove a connection and the link stops working at once.
Read-only unless you choose more
A new connection can only read numbers. Letting an AI record ad spend and costs, or propose store changes, is a choice you make per connection.
Store changes need your tap
An AI can only propose a price or cost change. It waits in Approvals inside your store admin. Approving needs a signed-in staff session; an AI's key cannot approve its own proposal.
No customer personal data
ProfitNod reads order totals, line items, product costs and payment fees. It never requests a customer's name, email, phone or address, and has no place to store them.
When you install, the store platform lists everything the orders permission could reach, customer details included. That list describes the permission, not what we take: our requests name the fields above and nothing else.
Encrypted and deleted
Store access tokens are encrypted at rest and expire by themselves; they are refreshed automatically. When you uninstall, access ends at once: the tokens are deleted and every connection link stops working. Your store's numbers are deleted when the store platform sends its deletion notice, 48 hours after the uninstall.
Everything is written down
Every change made in the app or by a connected AI is in the activity log, with who did it and when.
Report a problem
Found a weakness? Write to support@profitnod.com. We answer security reports first.