Security

An assistant that talks to your customers has to be safe by construction. Here is how Wekks is built.

Access

Read-only to start

Installing Wekks grants read access to customers, orders, products, fulfillments and your store policies. Changing orders (refunds, cancellations, new addresses) needs write access, which an owner grants separately from the dashboard, and can take back.

Signed in by Shopify

Opening Wekks from your Shopify admin signs you in; there is no separate password. Owners and admins manage the team; agents review the assistant's tickets.

Encrypted credentials

Tokens for Shopify and Gorgias are encrypted (AES-256-GCM) before they are stored.

Control

You decide what it may do

Each kind of request is Off, Watch (it sends nothing), Draft (a person approves) or Auto. Everything starts on Watch, and nothing reaches a customer unless you've allowed it.

Rules outside the AI

Every action passes a check written in code before it runs: the AI proposes, the rules decide. Refunds, reships and cancellations need a person's approval by default, and sensitive tickets always go to your team.

A full record

Every ticket keeps what the assistant saw, what it decided and why, so any answer can be explained later.

Isolation and hosting

Every record belongs to one store, and every query Wekks runs is scoped to that store.

Wekks runs on Fly.io in the United States (Virginia), with a managed PostgreSQL database. Ticket content is processed by Anthropic's Claude models to draft answers, and is never used to train them.

Reporting a problem

If you think you've found a security issue, write to hello@wekks-assistant.com.