Gorgias

Not Shopify-locked, and the agent writes rather than reads.

Gorgias builds native integrations for Shopify, BigCommerce and Magento, with Shopify order, customer and catalog data living inside Gorgias natively at one-click install and no data syncing, and runs a live App Store spanning ecommerce platforms, subscriptions, returns, shipping, marketing and support channels, each listing labeled first-party or third-party, with named partners including Omnisend, ReturnLogic, ChannelReply, Recharge and Loop, plus Zapier and Make for the long tail.

Authenticated action is documented: the AI Agent issues refunds, edits and cancels orders, changes addresses and updates subscriptions using live store data, and the Advanced options editor fires arbitrary HTTP requests to systems Gorgias does not natively integrate.

Sourcegorgias.com/appsread 2026-09-05

Agentic logic runs a loop rather than a script: the agent selects between answering from knowledge, performing an Action in a connected app, or starting a sales playbook, then asks whether the resources gathered will fully satisfy the request and launches additional parallel tasks if not, interpreting authored Guidance that branches on conditions such as VIP status, loyalty points and customer location until every step is complete.

Sourcedocs.gorgias.com/en-us/how-gorgiass-ai-agent-works-1997817read 2026-09-05

Knowledge sources are a first-class configuration the customer connects and the platform maintains: the Gorgias Help Center, the public website and product catalog, uploaded documents, connected public URLs and authored Guidance, all persisting across conversations and selected by relevance at answer time. Grounding is strict, with the agent documented as refusing to respond at all when the connected sources do not cover the question.

Sourcedocs.gorgias.com/en-us/onboard-ai-agent-with-knowledge-sources-1216498read 2026-09-05

Three vendor-owned gates run before anything reaches a customer: an inbound check for malicious activity and excluded topics, customer-defined exclusion and handover topics that route sensitive subjects to staff, and a second AI model that must clear a confidence threshold or the conversation is handed to a human instead of sent. Every AI message is labeled Automated in chat and can be reviewed with its sources.

Sourcedocs.gorgias.com/en-us/customize-how-ai-agent-hands-over-to-your-team-6008591read 2026-09-05

SOC 2 Type 2 since 2020 and HIPAA compliance published through a live Vanta trust center, with regular third-party penetration testing of application and infrastructure, GDPR and CPRA compliance, encryption and access controls over PII, SSO including Google, and a zero data retention policy required of model providers with interaction data deleted after processing. The attestation report itself is obtainable.

Sourceapp.vanta.com/gorgias/trust/jx7664gsj0n01vjw4ubstread 2026-09-05

Every AI-generated message is labeled Automated and can be reviewed alongside the sources it drew on, so which knowledge produced an answer is visible, and performance reports plus an Optimize page surface where the agent underperforms. Source attribution is not a decision trace, and no reasoning log covering which Actions were attempted, in what order, or why a branch was taken is documented, nor is a configuration audit trail.

Sourcedocs.gorgias.com/en-us/how-gorgiass-ai-agent-works-1997817read 2026-09-05

No memory layer, persistent state store or cross-conversation context is documented anywhere in the AI Agent documentation; the agent reads connected Shopify, helpdesk and knowledge data per request. The one persistence Gorgias does describe is ticket feedback influencing how the AI selects knowledge for similar questions later, which is learning absorbed into an optimization model rather than memory the buyer can locate or delete.

Sourcedocs.gorgias.com/en-us/how-gorgiass-ai-agent-works-1997817read 2026-09-05

Gorgias documents regional hosting on Google Cloud Platform across multiple servers globally, placing each account's data on the server closest to its location, so an EU customer is hosted in the EU. Placement is automatic by location rather than a customer-selectable region, and no VPC, single-tenant or on-premises option is offered.

Sourcedocs.gorgias.com/en-us/how-gorgiass-ai-agent-works-1997817read 2026-09-05

Shopping Assistant ships as a named role-specific skill set the customer turns on as a unit and configures on its own terms, with its own selling style and discount strategy settings, sitting alongside the default support behavior and a standard set of ecommerce actions. Only one packaged skill set is documented rather than a browsable library, and Actions are authored by the customer.

Sourcedocs.gorgias.com/en-us/customize-your-shopping-assistant-selling-and-discount-strategy-1216116read 2026-09-05

Broad channel coverage landing in one thread. Core channels are email, live chat, contact form and Help Center, with Facebook, Messenger, Instagram, TikTok and WhatsApp connected through the App Store, and SMS and Voice supplied by Gorgias itself rather than requiring a separate telephony vendor. The AI Agent is enabled per channel by toggle across those surfaces, with Gorgias noting SMS is the most tone-sensitive channel and should be tested before activation. SMS and Voice sit behind a separate add-on subscription.

Sourcegorgias.com/blog/ai-agent-guardrailsread 2026-09-05

Vendor-internal blending across multiple providers with no customer selection.

The AI Agent security and privacy FAQ states that its ability to recognize language and form sentences comes from a blend of state-of-the-art large language models from a few leading providers, including OpenAI and Anthropic, alongside Gorgias's own internal models, and Gorgias separately describes a direct OpenAI partnership giving deeper model access with ecommerce-tuned prompting layered on top.

No model selection, routing control or bring-your-own-model option is exposed to the customer anywhere; which model serves a given turn is Gorgias's decision.

Sourcedocs.gorgias.com/en-us/security-and-privacy-faq-for-gorgias-ai-agent-1997987read 2026-09-05

A public developer platform at developers.gorgias.com: a Developer Portal with sign-up, a Quickstart, a full API Reference and a Changelog, documented REST endpoints with pagination, rate limits and error handling, OAuth2 authentication with published scopes for public apps and HTTP Basic for private ones, and guides for creating integrations and widgets programmatically and for wiring a new channel in from a third-party app.

Third parties build and submit public apps for review and publication into the Gorgias App Store, so the platform is extensible from outside rather than only configurable from within. Gorgias also publishes an llms.txt index of every documentation page in Markdown with endpoints in OpenAPI.

SourceGorgias developer portal, API reference and llms.txt index; developers.gorgias.comread 2026-09-05

The Optimize page evaluates what the agent has already produced, identifying topics where it underperforms and directing the customer to the knowledge worth improving, and ticket-level feedback feeds back into how knowledge is selected; the pre-send confidence check is a runtime gate rather than a test. A test conversation feature at AI Agent > Test simulates customer interactions without affecting real tickets, reporting or customers, but no scored evaluation suite for trialing changes before go live is documented.

Sourcedocs.gorgias.com/en-us/how-gorgiass-ai-agent-works-1997817read 2026-09-05

No browser control, hosted session or computer use appears in any Gorgias documentation. The agent works programmatically instead: it acts through configured Actions against connected commerce APIs and native integrations, pulling live Shopify, Recharge and Loop data and writing back refunds, order edits and subscription changes, with an Advanced options editor firing HTTP requests to anything not natively integrated.

Sourcedocs.gorgias.com/en-us/how-gorgiass-ai-agent-works-1997817read 2026-09-05