What an AI client connected to MerchantFlow can and cannot do: read-only scopes, tenant isolation, PII redaction, what gets logged, token lifetimes, and how to revoke access.

MCP Security and Data Handling

Connecting an AI client to MerchantFlow grants that client permission to read your store's analytics on your behalf. This page states exactly what it can reach, what it cannot, what we record, and how to end the connection.

The connection is read-only

Every one of MerchantFlow's 59 MCP tools reads. None writes.

This is structural rather than a policy we apply. MerchantFlow defines thirteen granular read scopes and no write scope exists at all, so there is no permission a client could be granted that would let it change anything - not your MerchantFlow data, and not your connected Shopify, WooCommerce, or ad platform accounts. Every tool advertises readOnlyHint: true and destructiveHint: false in its tools/list entry.

If an AI client offers to refund an order, change a price, pause a campaign, or edit a product through MerchantFlow, it cannot. There is no tool to call.

Your data is isolated at the database layer

Every query an MCP tool makes is scoped to your store in the database itself, not filtered afterwards in application code. Another store's data is unreachable even if someone guesses or enumerates an internal ID.

Access tokens are bound to a single resource and carry your workspace identity as a signed claim. A token issued for one workspace cannot be replayed against another.

Customer personal data is redacted

Responses pass through a redaction layer that masks emails, phone numbers, names and addresses before anything leaves our servers. It is unconditional - there is no setting, on our side or yours, that turns it off.

The search and fetch tools used by ChatGPT's standard connector surface are built differently: rather than redacting customer fields, they never read them. Order documents from those tools carry order number, dates, status and money only.

You will still see aggregate customer analytics - cohorts, lifetime value, repeat purchase rate - because those are computed figures, not identities.

What we log

Every tool call writes an audit row containing:

Your workspace and the user who authorized the client
Which client called, and the client name it reported
Which tool ran, and the parameters it was given (with sensitive keys stripped)
How long it took, whether it succeeded, and the response size

You can review connected clients and recent usage under Settings > Developer > MCP (/dashboard/settings/developer/mcp).

We do not log tool responses, so your figures are not duplicated into the audit trail. We do not log access tokens.

What the AI provider sees

The tool results MerchantFlow returns are sent to whichever AI client you connected - Claude, ChatGPT, Cursor or another - and are handled under that provider's privacy policy, not ours. This is the same as any document or file you share with an AI assistant.

MerchantFlow does not choose what a connected client asks for. You do, through your prompts.

This is a separate matter from MerchantFlow's own in-dashboard AI features, which send data to a model provider on our behalf as our subprocessor. See the privacy policy for both.

Tokens and lifetimes

OAuth (the default for Claude, ChatGPT, Cursor, Windsurf and VS Code):

Access tokens last one hour.
A refresh token, issued only if you approve the "stay connected" permission, lasts 90 days and rotates on every use. Reusing a rotated token revokes the whole chain - that is how a stolen token is contained.
Authorization codes last 60 seconds and are single-use, bound with PKCE (S256 only).

Personal access tokens for headless environments:

You choose 30, 90, 180 or 365 days at creation.
The token is shown once and never stored. We keep only a SHA-256 hash, so a database copy cannot be turned back into a working token.

MCP Security and Data Handling