Signed in through Shopify
No passwords and no cookies. Every request from your admin carries a Shopify session token, and store access uses Shopify’s expiring tokens.
Security
Your store’s data, handled with care.
Our apps sit inside your Shopify admin and touch your orders, catalog and storefront. Here’s how we keep that access small, and the data safe.
How we protect it
Built in, not bolted on.
The same rules in every app, from the first line of code.
Least access
Each app asks only for the permissions its features need, and writes to your store only where a feature must.
Encrypted secrets
Store tokens, API keys and push credentials are encrypted with a dedicated key, never sent to a browser or a phone. HTTPS everywhere.
Every store kept apart
Each store’s data is fenced off from every other store’s, and automated tests check that it stays that way.
Verified webhooks
Every message from Shopify is signature-checked, processed once, and trimmed to the fields the feature needs.
AI with guardrails
AI sees catalog and brand facts, never customers or orders. Its output is checked against strict rules and saved as a draft for you to review.
Roles and an audit trail
Mobile App Builder gives your team roles, from owner to viewer, and logs every design, publishing and billing change, with secrets left out.
Kept short, then deleted
Nightly jobs delete data a feature no longer needs. After you uninstall, everything about your store goes too.
Retention periodsAccess by app
What each app can see and change.
You approve these permissions in Shopify when you install. This is what they’re for.
| App | Reads | Changes in your store | Never touches |
|---|---|---|---|
 Mobile App Builder | Products, collections, menus and discount codes. Orders placed in your app, without customer details. | Publishes products to your app’s sales channel. | Shoppers’ names, email addresses, phone numbers and street addresses |
 Pick List | Orders’ items and fulfillment locations. Product titles, SKUs, barcodes and bin locations. | Adds the “picked” tag to orders. | Customer names, email addresses, phone numbers and street addresses |
 Pickup Label | Local-pickup orders, and the customer’s name for the label. | Marks orders ready for pickup, and adds the “printed” tag. | Email addresses, phone numbers and street addresses |
 SEO 404 Redirect | Product, collection, page and blog addresses and titles. Menus, and whether its tracker is switched on in your theme. | Creates, changes and removes URL redirects. | Orders, customers and visitors’ IP addresses |
Defence in depth
The quieter safeguards.
- Rate limitsOn app requests, printing, store changes and sign-in, counted per store or per address.
- Strict validationEvery request is checked. In Mobile App Builder, app designs and campaigns must also match a strict schema.
- Safe outbound callsWhen Mobile App Builder fetches a web address for you, it must be a public HTTPS site, checked again at every redirect.
- Store text is dataInstructions hidden in product text can’t steer our AI. At most they become a draft you can undo.
- Keys that expireWhen you connect your own AI tool to Mobile App Builder (Scale and up, coming soon), its key is stored only as a hash, can only make drafts and expires after 30 days.
Responsible disclosure
Found a security issue? Tell us first.
Email us with “Security” in the subject, the app or page involved, and the steps to reproduce it. We’ll confirm we got it, keep you posted while we fix it, and thank you by name if you’d like.
Please do
- Test only on a development store you own.
- Give us reasonable time to fix it before you tell anyone else.
- Stop and tell us as soon as you see someone else’s data.
Please don’t
- Access, change or keep other merchants’ data.
- Run denial-of-service or load tests.
- Try phishing or social engineering on our team.
Want the details?
Our Trust Center brings privacy, security and Shopify’s data rules together. Our Data Processing Agreement sets out the security measures we commit to.