Security

A new connection begins read-only. Mondext can see the economics of your store — orders, products, discounts, shipping rules and, as integrations launch, ad spend — but it cannot change anything.

Write access is requested only when you decide to let Mondext apply changes, and only for what those changes need: a discount rule, a campaign budget, a threshold.

You write the limits as Profit Rules — a minimum contribution margin, a maximum CAC, a daily stop-loss — and choose how far Mondext may go:

• Watch never changes anything. It tells you what it found.
• Approve prepares each change with its evidence and expected impact, then waits for you.
• Autopilot acts on its own — only within the rules you set, and only for the kinds of change you allowed.

Mondext starts in Approve mode. Nothing reaches your store until you have seen what will change, why, and what it is expected to do — and clicked approve.

Every action Mondext takes is written to an audit trail you can read:

• what changed, and the value it replaced;
• which rule or approval allowed it, and when;
• what happened afterwards, as Mondext keeps measuring the result.

Keeping the previous value means every change can be reviewed — and, where the platform allows, put back.

Traffic between your browser, Mondext and the platforms it connects to travels over encrypted connections (TLS). Access tokens for connected platforms are kept on the server, never in your browser.

Mondext reads what it needs to understand profit — prices, costs, discounts, shipping, refunds and spend. It does not need, and does not request, your customers’ payment details, and it never asks for your store password.

You can remove Mondext from your store’s platform at any time, and its access ends there. Cancelling your plan also stops Mondext from acting on your store.

Mondext is pre-launch. We do not hold SOC 2 or ISO 27001 certifications today, and we won’t display badges we haven’t earned. As the product matures we will publish more detail here — including any independent assessments once they exist.

If you believe you’ve found a security issue, please tell us through the contact page with “Security” in your message. Give us a reasonable chance to fix it before sharing it publicly.

Please test only against your own accounts, never access or modify other people’s data, and avoid anything that degrades the service for others. We’ll acknowledge every good-faith report.