# An AI agent on your site, with you in control. > Security in Bixlow rests on an asynchronous script that fails silently, runtime-injected changes that disappear when a workflow is stopped, publishing that a person always approves, data processed in the European Union, and each customer's data isolated at the database level. - Source: https://bixlow.com/en/security - Language: en - Publisher: Bixlow Letting an AI build changes on your site only makes sense if nothing can break it, nothing ships without approval and everything is recorded. That is how Bixlow is built. - **If Bixlow is unreachable:** Your site looks the same - **Publishing:** Always approved by a person - **Data:** Processed in the EU - **Customers:** Isolated in the database ## What procurement, IT and legal ask Before installing a third-party script, especially one that uses AI, there are fair questions that deserve a concrete answer. ### What if the script breaks the site? A third-party script that fails or hangs can block page load or leave the page half-rendered in front of your customers. ### What if the AI publishes something it shouldn't? A change generated without review can reach production with copy, an offer or a design nobody approved. ### Where does my visitors' data go? Test assignment and measurement shouldn't need personal data or leave the EU. ### Who made this change? When several people and an AI work on the same site, you need to know who did what and be able to roll it back. ## How Bixlow protects your site Each layer answers one of those questions. 1. **The script never blocks your site.** It loads asynchronously and fails silently: if Bixlow can't be reached, your site renders exactly as it would without it. 2. **Changes are not written into your theme.** They are injected into the page when it loads. Stop a workflow and the change disappears on the next page load. 3. **A person approves every publish.** The agent proposes and builds; publishing is always a human decision. You can review the change in the preview first. 4. **Everything is recorded.** The activity log keeps who did what, including what the AI did, and the version history lets you roll back. ## The guarantees, one by one No fine print: this is what the product does today. ### Your site: Built so it never takes your site down The script and the changes are designed so your site keeps working whatever happens. - Asynchronous script that fails silently. - Changes injected, never written into the theme. - Action chains protected against loops. ### Control: The AI proposes; a person decides Nothing the agent builds reaches your visitors without someone approving it. - Preview before publishing. - Version history with restore. - Deactivating a workflow in one click also turns off its tests. ### Data: In the EU, with no personal data in assignment Test assignment uses a first-party identifier generated in the browser, not personal data. - Data processed in the European Union. - Country comes from the network, not from what the browser claims. - Functions secrets are stored encrypted. ### Isolation and logging: Each customer kept apart; every action noted Each customer's data is isolated at the database level, and every project has its own activity log. - Isolation between customers in the database itself. - An activity log that tells apart what the AI did. - Each project is accessible only to its members. ## What the agent can do, and what it can't The agent works inside your project, with your permissions. What it can't do is publish on its own. ### You decide - Who has access to each project. - What gets published, and when. - Which workflow is stopped or restored. - Which keys are stored as secrets. ### The agent does - Builds changes as drafts for review. - Leaves a record of each action in the log. - Lists versions and restores the one you ask for. - Asks when it is missing information. ### An activity log entry - **Who:** AI agent, at a team member's request - **What:** Created a free shipping bar in a draft - **Where:** "Product page" workflow - **Published:** No ยท waiting for approval ## Bixlow Studio: Does your IT team need concrete answers? Bixlow Studio supports installation and setup with your technical team, and answers procurement, IT and legal questions about how Bixlow works on your site. - Script installation in the head or through Google Tag Manager. - A review of how your goals are measured. - Answers for your technical and legal teams. ## FAQ ### What happens if Bixlow goes down? The script loads asynchronously and fails silently. If Bixlow can't be reached, your site renders exactly as it would without it. ### Can the AI publish changes without anyone approving them? No. The agent proposes and builds, but publishing is always a person's decision. ### Does Bixlow change my site's code? No. Changes are injected into the page when it loads and nothing is written into your theme. Stop a workflow and the change disappears on the next page load. ### Where is data processed? In the European Union. Test assignment uses a first-party identifier generated in the browser, with no personal data. ### Can other customers see my data? No. Each customer's data is isolated at the database level, so a query never returns another customer's data. ### Can I see what the AI changed? Yes. The activity log records who did what in each project, including what the AI did, and the version history lets you go back to any earlier version. ## Try it with your technical team in the room Install the script, review what the agent builds and decide what gets published. If you have specific questions, talk to the Studio.