Documents answer prospects; data answers customers
A bot trained on your content serves people evaluating you. Existing customers ask about their own order, their own account, their own booking.
Those questions need live data, and that is a different piece of work.
Three requirements
- An API to read the data from
- An identity check, so you know who you are answering
- A decision about what may be revealed to a partially-verified visitor
The third is the one that needs care. An order number and an email address is a weak identity check, and it is what most implementations settle for.
What is safe to answer
| Question | Verification needed |
|---|---|
| Is this product in stock? | None — public information |
| What are your delivery times? | None |
| Where is order 12345? | Order number plus email or postcode |
| What is my account balance? | Proper authentication |
| Change my delivery address | Proper authentication, plus confirmation |
Never let it act without confirmation
Reading is one risk level; changing something is another. Any action — cancelling, amending, refunding — needs explicit confirmation and should usually reach a person.
The convenience gained is small; the exposure created is not.
What it costs
A read-only integration for order status is typically £3,000–£7,000 depending on the system. Authenticated account access is more, because the identity handling has to be done properly.
Both are far below a custom build, and both deliver the thing existing customers actually want.