Most CRM breaches don’t hit the CRM, they hit a third-party app that mishandled its access tokens. Here is exactly how the Zaags assistant connects to your WooCommerce, and what keeps your data safe.
The assistant connects to your own store with a WooCommerce REST API key that you create with Read permission only, over HTTPS. We never hold an admin password, and you can revoke the key in WooCommerce at any time.
The key needs Read permission only, never Read/Write. The assistant only reads customers and their own orders, it never writes, edits or deletes anything in your store.
Access keys are stored encrypted (AES-256), never in plain text, never in our database in clear, and never shared with anyone. Your consumer key and secret are encrypted at rest and never leave our server.
When you disconnect, we delete the key from our side immediately. For certainty, also revoke it in WooCommerce → Settings → Advanced → REST API, a revoked key can never be reused.
Before revealing anything personal, a customer is verified with a one-time passcode matched against your WooCommerce customers. No verification, no personal data.
We use the standard WooCommerce REST API no plugin to install and no code added to your store. Setup takes about ten minutes and every action is written to an audit log.
Every call from the assistant comes from a single IP. Lock your connection to it so only we can use it:
Security is shared. These settings live in WooCommerce, we recommend them all, and our setup guide walks you through each:
209.16.158.237.Your keys are yours, encrypted, least-privilege, revocable in one click, and only ever used from one address, with a customer identity check before any personal data is shared. If a vendor can’t explain that simply, they shouldn’t hold your keys.