> ## Documentation Index
> Fetch the complete documentation index at: https://chariow.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security best practices

> Understand data sharing and security when using Chariow MCP

When you connect an AI tool to your Chariow store via MCP, you're granting that tool access to your store data. This page explains what data is shared and how to stay secure.

## What data is accessible?

Once connected, the AI tool can read:

| Data type     | What's included                                                |
| ------------- | -------------------------------------------------------------- |
| **Store**     | Name, description, logo, URL, settings, subscription status    |
| **Products**  | Names, descriptions, pricing, images, categories, sales counts |
| **Customers** | Names, emails, phone numbers, purchase history                 |
| **Sales**     | Amounts, payment details, shipping addresses, customer info    |
| **Discounts** | Codes, values, usage counts, restrictions                      |
| **Licenses**  | Keys, activation counts, status, expiry dates                  |
| **Analytics** | Revenue, visits, conversion rates, traffic sources             |

<Warning>
  **All MCP tools are read-only.** The AI cannot modify your store, create products, or process transactions. However, it can read all data associated with your store.
</Warning>

## Who can see your data?

When you connect via MCP:

1. **Your AI tool** (Claude, ChatGPT, etc.) receives your store data to answer your questions
2. **The AI provider** may process and store this data according to their privacy policy
3. **Chariow** acts as the bridge and does not store conversation data

<Info>
  **Review your AI provider's privacy policy.** Each provider handles data differently. Chariow is not responsible for how third-party AI providers process, store, or use your data.
</Info>

## Security recommendations

### Only connect trusted tools

Only use MCP connections from AI providers you trust. Verify you're connecting to official tools:

* Claude from Anthropic
* ChatGPT from OpenAI
* Cursor, Windsurf, or other reputable tools

### Verify the MCP endpoint

Always confirm you're connecting to the official Chariow endpoint:

* `https://mcp.chariow.com/public`

### Be mindful of prompts

AI assistants follow instructions, including those hidden in data. Avoid:

* Pasting untrusted content into conversations
* Asking the AI to process external URLs or files without review

### Review access regularly

Periodically check your connected applications:

1. Go to your [Chariow Dashboard](https://app.chariow.com)
2. Navigate to **Settings** → **API Keys**
3. Revoke any connections you no longer use

### Use separate stores for testing

If you're experimenting with MCP integrations, consider using a test store rather than your production store with real customer data.

## What Chariow does

* **OAuth authentication**: Secure authorisation flow with no API keys stored in config files
* **Read-only access**: All tools can only read data, never write
* **Rate limiting**: 60 requests per minute prevents abuse
* **HTTPS only**: All connections are encrypted

## What Chariow does not do

* Store your conversations with AI tools
* Share your data with other users or third parties
* Control how AI providers process your data
* Monitor what questions you ask

## Revoking access

To disconnect an AI tool immediately:

1. Go to **Settings** → **API Keys** in your Chariow Dashboard
2. Find the MCP connection
3. Click **Revoke**

The AI tool will lose access to your store data immediately.

***

## Next steps

<CardGroup cols={2}>
  <Card title="Setup guide" icon="plug" href="/en/mcp/setup">
    Connect your AI tool
  </Card>

  <Card title="Supported tools" icon="toolbox" href="/en/mcp/tools">
    See available tools
  </Card>
</CardGroup>