Skip to main content
Connecting an assistant means letting a third-party AI product read your business data. This page sets out exactly what that involves so you can decide who on your team should connect one.

​
Scope

  • One account. The assistant sees the storekit account of the person who signed in (their first account, if they belong to several), and nothing else. Every request is scoped to that account on the server; the assistant cannot ask for another account’s data by guessing an ID.
  • All stores on that account. Access is not narrowed to the stores a user can see in the dashboard. If a manager who only works one store connects an assistant, the assistant can still report on every store on the account.
  • No user-level permissions. The dashboard’s user roles do not apply to the assistant. Treat “can connect an assistant” as equivalent to “can read everything on the account and can create discount codes and payment links”.
Because of the last two points, connect assistants only for people you would trust with account-wide reporting and with creating payment links.

​
Read and Write

Sixteen of the eighteen tools are read-only. The two writes are: Claude, ChatGPT, Cursor, VS Code and Claude Code ask you to approve a write before it runs by default, but that prompt belongs to the client, not to storekit: a client set to auto-allow tools or a custom agent runs writes without any confirmation. Keep approval prompts on. Nothing else on the account — orders, menus, settings, users, payouts — can be changed through the assistant. Creating a payment link also sends the payment_link.created webhook if you subscribe to it, exactly as it would from the dashboard.

​
What Your Assistant’s Provider Sees

Whatever storekit returns to the assistant — order details, customer names on orders, totals — is processed by the assistant’s provider (Anthropic, OpenAI, Cursor, and so on) under their terms. storekit does not control what they retain or train on. Check their data policies, and prefer business or enterprise plans that exclude training, if that matters to you.

​
What storekit Records

For every request the assistant makes, storekit records:
  • which tool was called, when, how long it took and whether it succeeded;
  • the names and types of the arguments — for example “a store ID and a date range” — but not their values;
  • which user made the call, and the name and version of the assistant software.
storekit does not record the data returned to the assistant. This log is used to run and improve the service and to investigate problems. Writes are additionally logged on the server with the account and the user that made them.

​
Disconnecting

Disconnecting is immediate and does not delete anything the assistant has already been shown. Remove the connector in the assistant itself — see the “Disconnecting” section of your connect guide. There is no list of connected assistants in the storekit dashboard. If a user leaves your team, remove them from the account under Members — click your profile in the bottom-left sidebar (see Team Members). Their sign-in stops working, and so does any assistant they connected.

Users

Managing who has access to your account.

Event Tracking

How storekit handles analytics data more broadly.