The short answer
Connect only the sources your questions need, with read-only access, and find out beforehand how you take access back. In SAR Intelligence, Google sources use read-only permissions, the AI app gets read tools only, and you can revoke it within about a minute. Take extra care with Magento, where the AI app can read customer names, emails and order history.
Before you connect a Magento store, read what the Magento connection can read, customer records included.
Key points
- Read-only access lets the AI app read your data. It cannot change anything.
- WooCommerce orders reach the AI app without customer names, addresses, emails or phone numbers.
- A Magento connection includes customer records. Decide whether your questions need them.
- Find out where to revoke access before you grant it.
What each connection can reach
| Source | What the AI app can read | Limit |
|---|---|---|
| Google Analytics | Reports, conversions, funnels and property details for one property | Read-only Google permission. Settings cannot be changed. |
| Search Console | Queries, clicks, impressions, pages, sitemaps and indexing for one site | Read-only Google permission. Nothing can be submitted or removed. |
| WordPress and WooCommerce | Published posts and pages on any WordPress site. With WooCommerce, also products, orders, stock, sales summary and categories | Orders exclude customer names, addresses, emails and phone numbers. No write tools are allowed. |
| Magento / Adobe Commerce | Orders, invoices, products, inventory, customers, reviews and more | Customer names, emails and order history are readable. The app warns you first. |
1. Check that access is read-only
An AI app should be able to read your data without being able to change it.
In SAR Intelligence, Google Analytics and Search Console use Google's read-only permissions (analytics.readonly and webmasters.readonly). ChatGPT and Claude see read tools only. The WooCommerce connection allows no write tools.
2. Limit what each connection reaches
Each connection points to exactly one GA4 property, one Search Console site or one store. Each AI connector reaches one organization, and each organization is isolated from every other.
Agencies keep client data apart by creating one organization per client.
3. Decide about customer data
Most questions about traffic and sales need no customer details. WooCommerce orders reach the AI app without names, addresses, emails or phone numbers.
In Magento, the AI app can read customer names, emails and order history, and the SAR Intelligence app warns you before you connect. Think about who on your team will use that connection and whether your questions need it.
4. Know what is stored
Ask any provider what it keeps. For SAR Intelligence, the list is below. Your conversation history follows ChatGPT's or Claude's own settings.
- Source credentials are encrypted at rest and never shown back.
- SAR does not record the questions asked or the data returned.
- Failure records are kept for 30 days.
- The most recent 14 backups are kept, replaced nightly.
- Expired OAuth tokens are purged daily.
5. Know how to revoke access
Before you grant access, find where you take it back.
- Revoke an AI app in the SAR Intelligence app. It takes effect within about a minute.
- Disconnecting a Google source also revokes SAR's Google access.
- The activity log records connections, chosen properties, AI access grants and revokes, role changes and invitations.
Questions to try
- Which landing pages brought in the most visitors this month?Sources: Google Analytics
- Show me our most recent orders.Sources: WooCommerce
- Which products are running low on stock?Sources: WooCommerce
- Which products sold best this month?Sources: Magento
Questions people ask
Does read-only access remove every risk?
No. It prevents changes to your data. You still decide who on your team uses the AI app, which sources to connect and whether customer records belong in the conversation. AI answers can also be wrong or incomplete.
Does SAR record my questions?
No. SAR does not record the questions asked or the data returned. It keeps the connection details it needs to reach your sources, encrypted.
What happens when I disconnect Google Analytics?
SAR's Google access is revoked as well, and the AI app can no longer read that property.