Security
Trusted with the keys.
Asks before it turns them.
Zoex works inside your store and your ad accounts, so it’s built to be safe there first. The rules below live in its code, not in a prompt it could talk itself out of.
Approvals
Some things always ask.
For most changes you decide, kind by kind, whether Zoex asks or just does it and tells you. These always wait for a person, whatever you allow. Only your owner or an admin can widen what Zoex does alone; Zoex can’t.
The full list, from Zoex’s codeGoogle Ads
- Change a budget
- Turn a campaign on
- Change a ROAS or CPA target
- Create a campaign or an ad group
- Change where or in which languages a campaign shows
- Start, keep or end an experiment
- Change Shopping bids
Shopify
- Change a price
- Create or end a discount
- Publish a theme
- Publish a blog post or a page
- Refund an order
Email and the outside world
- Email your customers
- Send an email as your brand
- Post anything in public
- Delete data
Zoex itself
- Give itself more room to act alone
- Change how it works for your brand
- Turn on or change an automation
How we protect your data
Safe by design, not by promise.
Keys encrypted, customer details left where they are
The keys to your store, ad accounts and apps are encrypted at rest. Zoex doesn’t copy your customers’ personal details out of Shopify; when an automation needs a customer’s email to send something, it reads it at that moment and masks it in every record.
Outside text is information, never orders
Emails, web pages, reviews and Reddit threads can carry hidden instructions. Zoex marks everything it reads from outside and never takes orders from it. Before a change runs on its own, a second, independent check reads it against your team’s own words, and it waits for a person when in doubt.
A sealed computer for each task
When Zoex runs code, it does so in an isolated computer made for that one task and removed when the task ends. It never holds the keys to your accounts.
Each person sees their part
Roles and access go down to a single store, ad account or app account. Zoex works with what the person asking may use, and a shared Slack channel gets only what everyone in it may see.
Every change, on the record
What was proposed, who approved it, what it changed and the value from before: all kept, so you can see it and undo it.
Your data never trains a model
Zoex runs on Anthropic’s Claude through its business API, which doesn’t train on your data. Other models used for side tasks are called with zero data retention.
Sign-in done right
Email confirmation, a bot check on every sign-in form, secure HTTP-only sessions, and invitations bound to the address they were sent to.
Logs without your content
Our operational logs hold IDs, counts and timings only, never your messages, answers or data.
Where your data lives
Zoex’s database and app run in the European Union, in Frankfurt, on Supabase and Vercel, with payments through Stripe. Every company that handles your data is named on our Subprocessors page.
Found a problem?
Tell us through the app. We read every report and answer quickly. Please don’t test on other customers’ accounts.
Give Zoex its first job.
Start with 2,000 free credits. Connect Shopify, Google Ads or Slack, and ask it anything.
No card needed