Skip to main content

Security & FAQ

Is my data safe?​

The MCP server is read-only in this release. A connected AI can look up and analyze your SellerJar data, but it cannot change campaigns, bids, budgets, or any other setting.

What can the AI actually see?​

Only the advertising profiles you have access to in SellerJar. When an AI connects, it first calls list_profiles to discover which profiles it's allowed to look at (or, if you only have one profile, tools use it automatically without an extra round trip), and every subsequent tool call is checked against that same per-profile authorization: an AI can never reach into a profile you don't have access to.

Is every action logged?​

Yes. Every tool call made through the MCP server, from any connected AI, is recorded in your account's AI audit log, whether it succeeds or is denied.

Are there rate limits?​

Yes, 300 requests per hour per user. If you hit the limit, the AI will get an error back and you'll need to wait before making more calls.

How does the API key work?​

  • Keys are generated from Settings → Account Settings → MCP API Key and are shown in full only once: copy it before closing the dialog.
  • Keys are stored hashed, not in plain text, so SellerJar itself can't display a lost key, only a new one.
  • You can rotate or disable your key at any time from the same settings page. Rotating immediately invalidates the old key.

Can I revoke access from an AI I connected via OAuth?​

Yes, and it takes effect immediately. The MCP page shows a Connected AI clients card listing every AI (Claude.ai, ChatGPT, etc.) currently connected via OAuth. Click revoke next to any of them to cut off access: the next request from that client is rejected right away, even though its short-lived access token technically hasn't expired yet. Your access is checked against your account fresh on every single call, not just at connect time, so a revoked or demoted account loses access immediately too.

What happens if I change my password?​

Changing your password disconnects any AI you connected via OAuth (Claude.ai, ChatGPT): you'll need to reconnect and approve again.

It does not affect an API key connection (Claude Code). If you want to be sure a key-based connection is cut off, rotate or disable the key directly, or revoke it from the Connected AI clients card.

Where does my data actually go?​

When you connect an AI, the data it retrieves through SellerJar is sent to that AI provider (for example, Anthropic or OpenAI) under your own account and agreement with them: SellerJar doesn't control what that provider does with the response after it leaves our server.

Can I trust everything the AI tells me?​

Some tools can surface third-party content as part of their results (for example, keyword research results pulled from external data). Treat AI-generated answers with the same judgment you'd apply to any third-party content, and verify anything you're about to act on.

What about OAuth security specifically?​

OAuth connections use PKCE (Proof Key for Code Exchange), a standard security mechanism that prevents the authorization code from being intercepted and reused by another party during the connection flow.

Related​