What can an AI Editing token do, and how do I stop it?

A token is the person who made it. The AI can do what that person can do, on every website in the account that they can edit. Its changes go live as it makes them, or it saves a page change as a draft when you ask it to. If you have an unpublished draft of a page open in the CMS, a change the AI makes live does not publish your draft; your draft picks up its change the next time you open it. Every publish is kept in the page’s history, so a change can be rolled back from the page in the Website Builder. Menus keep their own history.

Anyone with the connector address can edit those websites, so keep it private. To cut an AI off, open Data API & ChatBot Tokens and select Rotate (a new address, the old one stops working) or Delete. Removing someone from your team also stops every token they made. Tokens are free; the AI app runs on your own plan with that app.

A token reaches only the websites of the account it was made in, and only the ones its person can edit. That is checked on the Podspun side for every request, so nothing typed into the AI, and nothing it reads, can point it at a website in another account. Every connection, read and change is recorded in the activity log with the time, the app, the IP address and place, what the AI sent, and the values each change replaced, including the full content of any page it deleted. A change to a page, the settings, the theme, menus, redirects or social links has an Undo button there that puts it back, and so do a deleted page and a discarded draft. Other changes, such as an event, a film, a form or a quiz, are recorded with what they replaced and are put back by hand. An undo is logged too and can be undone the same way. The log is kept for a year.