Security & Trust
Your store data stays yours
Cart Agent is built with security as a default. You control your data, your AI providers, and your privacy settings.
Encrypted credentials
All API keys and license credentials are encrypted at rest using AES-256-GCM — the same encryption standard used by financial institutions. Your credentials are never stored in plaintext.
WordPress-native access control
Every admin action in Cart Agent is protected by WordPress capability checks (manage_woocommerce, edit_products) and nonce verification. Unauthorized users cannot access or modify store data through Cart Agent.
You control AI connections
Cart Agent never sends store data to a third-party AI provider you haven’t explicitly connected. You choose which provider to use (OpenAI, Anthropic, Gemini), and you can disconnect at any time.
Opt-in analytics only
Anonymous usage analytics are opt-in, not enabled by default. You decide whether to share any usage data, and the data collected is anonymous — never tied to your store’s specific products or customers.
What data does Cart Agent access?
Data Cart Agent reads
Cart Agent reads your WooCommerce product data (titles, descriptions, prices, images, categories), order data (totals, dates, statuses), and customer data (purchase history, segment classification) to power its three assistants.
This data stays within your WordPress installation. It is only sent to an AI provider when you explicitly initiate an AI-powered action (a chat conversation, content generation, or AI report) — and only to the provider you’ve connected.
Data Cart Agent does not access
Cart Agent does not access customer payment information, passwords, or any data outside of WooCommerce’s product/order/customer scope.
Cart Agent does not create separate user accounts, external databases, or off-site data stores. Everything lives inside your WordPress installation.
Native WordPress architecture
Cart Agent is a native WordPress plugin. It doesn’t require a separate application, external login, or data synchronization service. There is no “Cart Agent cloud” where your store data is copied to.
This means your data security is directly controlled by your WordPress hosting environment, your access controls, and your decisions about which AI providers to connect. Cart Agent inherits and respects your existing WordPress security infrastructure.
The Security Behind Cart Agent
Everything you need to know about encryption, user access, data privacy, third-party sharing, and what happens to your data when you uninstall Cart Agent.
API keys and license credentials are encrypted at rest using AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode, 256-bit keys). This is one of the strongest symmetric encryption standards available.
Cart Agent uses WordPress capability checks to control access. Only users with manage_woocommerce or edit_products capabilities can access Cart Agent features. This typically means only administrators and shop managers.
Cart Agent only sends store data to an AI provider you’ve explicitly connected (OpenAI, Anthropic, or Gemini). No data is shared with any third party without your direct action. Anonymous usage analytics are opt-in only and not enabled by default.
Since Cart Agent is a native WordPress plugin, uninstalling it removes its data from your WordPress database. Your WooCommerce product, order, and customer data remain untouched — Cart Agent reads this data but does not modify or own it.