WordPress
An application password that WordPress creates when you approve Mitos on your site's own screen. You can revoke it in WordPress at any time; disconnecting in Mitos revokes it too.
Security and data access
What Mitos can reach, and how you stay in control
Mitos reads your sources so ChatGPT or Claude can answer, and works on your site only within the limits you set. This page says exactly how.
How a request travels
Five steps between your question and the answer.
You ask
In ChatGPT, Claude, Claude Code or Cursor, in your own words. The AI assistant decides which Mitos tool to call.
The AI assistant calls Mitos
Over MCP, with a token for one organization that you authorized. A second organization needs a second connection.
Mitos checks
The organization, your role, the source you chose, whether changes are allowed there, and how risky the tool is.
Mitos asks the source
Google through read-only permissions, your WordPress site through its plugin with signed requests, Magento through its token.
The answer goes back
Straight to the AI assistant. Mitos does not keep the question or the data; a change waits for approval first.
What Mitos holds, and what it does not
Kept to what the service needs to work.
Mitos holds
- Your account: name, email, a password hash, and two-factor or passkey details if you turn them on
- Each connection: the site or the properties you chose, its status and checks, and the credential to read it, encrypted at rest
- Approvals, changes made through Mitos and the activity log, so you can see who asked for what
- Usage counts per day, for plans and limits
- Failure records for 30 days, and the most recent 14 backups, replaced nightly
Mitos does not hold
- Your questions or the answers
- Your analytics, search or store data: it is read when asked and passed straight on
- WordPress passwords: WordPress creates the application password on its own screen
- Customer names, emails, phones or addresses from WordPress: they are masked on your site first
- Card details: payments go through Stripe
Who holds which key
Every credential can be taken back, by you, at its source.
An authorization with read-only scopes (analytics.readonly, webmasters.readonly), plus edit for the Google Analytics properties you chose, only if an owner or admin allows changes. Disconnecting revokes it.
Outside SEO data
Your own provider key (DataForSEO, Semrush, Ahrefs or SE Ranking), encrypted, used only within the per-call cap and monthly budget an owner set.
AI assistants
An OAuth token for one organization. Revoke it in Mitos under AI access; it stops working within about a minute. Expired tokens are purged daily.
Safety defaults
On for everyone, from the first connection.
- Every source starts read-only until an owner or admin allows changes
- New posts, pages and products start as drafts
- Publishing, prices, stock, orders and refunds wait for a person's approval, in the chat where your AI assistant supports it, otherwise in Mitos
- Plugins, themes, updates, search and replace and administrators also need an extra check that it's really you: in the chat, a 6-digit code from your authenticator app or sent to your email; in the Mitos dashboard, your Mitos account password, never your website's. A person, not the AI, confirms every risky change
- Every WordPress change is logged and can be undone for 30 days
- A backup through your own backup plugin is offered before risky changes
- Code snippets are created switched off
- No tool runs arbitrary code; database queries are read-only and secrets are hidden
What each connection can reach
A WordPress connection points to one site and a Magento connection to one store. A Google connection reads only the properties you choose, each for one of your sites; everything else the Google account reaches stays private.
WordPress and WooCommerce
Content, builders, media, SEO fields, settings, plugins and themes, products and orders. Orders never include a customer's name, address, email or phone.
Google Analytics
Reports, realtime, conversions, funnels and property details; with changes allowed, new custom dimensions, metrics, key events and audiences, each approved.
Search Console
Queries, clicks, impressions, pages, sitemaps, URL inspection and indexing issues. Read-only.
Magento
Orders, products, inventory, customers and returns, read-only. The one source where the AI assistant can read customer names, emails and order history; the app warns you before you connect.
Training
None.
Mitos has no AI model of its own and does not use your data to train one, or let anyone else do so.
What ChatGPT or Claude keeps from a conversation follows their own settings and terms, which you control in those apps.
Subprocessors
The companies that process personal data for us: Google, Stripe, Cloudflare, an EU host and a certified Greek e-invoicing provider.
Certifications, honestly
What we have and what we do not.
- Mitos has no SOC 2 or ISO 27001 certification. We would rather say so than imply one.
- There is no uptime guarantee (SLA) yet: Mitos is in a pilot with design partners.
- Connections use TLS, stored credentials are encrypted, and backups are encrypted and kept off the server too.
- Two-factor authentication and passkeys are available for every account.
If something goes wrong
We tell affected customers without undue delay after we become aware of a personal data breach, with what we know, and add to it as we learn more. The data processing terms set this out.
Your controls
Everything here is in the Mitos app, for owners and admins.
Allow or stop changes
Per source. Turning changes off leaves the source read-only at once.
Revoke an AI assistant
Under AI access. It stops within about a minute.
Disconnect a source
Revokes the access Mitos has to that Google account or WordPress site.
Decide who can do what
Roles are Owner, Admin, Analyst and Member.
See every change
The activity log, and every WordPress change can be undone for 30 days.
Leave
Delete the organization or your account; deleted data leaves the backups within 14 days.
Limits you should know about
- ChatGPT or Claude writes the answers, and they can be wrong or incomplete. Check important figures in the source.
- A Magento connection gives the AI assistant access to customer names, emails and order history.
- Updates, deleted spam and emails already sent cannot be undone.
The documents
Drafts until a lawyer has reviewed them, and they say so.
Start free
Install the plugin, add Mitos to your AI and ask your first question within minutes. No card needed.