Security at Wilmo
How we protect your customers' data today, and what we're building next.
What we have today
LLM-Based Fraud Risk Detection
Before sharing sensitive information or taking actions in systems like Shopify (e.g. cancelling an order), our agent calls a dedicated tool: check_fraud_risk.
This calls a separate AI model that decides whether it's safe to share the information or go through with the action. The fraud check runs independently from the support conversation, so it can't be influenced by the customer's messages.
Identity Verification Policy
Before sharing or acting on personal information, we require the customer to verify their identity. This is the same standard human support agents follow:
2 hard datapoints
The customer must provide their email address + an order number.
3 soft datapoints
If the customer can't find an order number, they can provide their email address + delivery address + order total amount.
What we are developing
Session-Based Authentication
We're moving identity verification from conversational to cryptographic. The AI agent will only be able to look up orders for the exact email address that has been verified by the customer.
Email-based tickets
The sender email is automatically verified. No extra steps needed.
Instagram & live chat tickets
We send the customer a verification email to confirm they own the email address. Same idea as a magic link login.
The agent only gets access to look up orders once the email is verified. Even if someone tries prompt injection or other tricks, the agent simply does not have the ability to access data it hasn't been granted access to.
Timeline
We're already building session-based authentication and plan to roll it out in April 2026.