Security & trust.

The base analytics connection requests read_customers, read_orders, and read_products. Approved stores may separately grant read_all_orders for history beyond Shopify's standard window. These scopes cannot edit orders, themes, checkout, or customer records.

Only when a merchant explicitly enables Shopify loyalty reward issuance does a separate OAuth step request write_discounts, used solely to create the requested discount codes. Retrics does not request checkout, payment, fulfillment, order-write, or theme-write scopes.

The Shopify install runs through OAuth with a signed, single-use state parameter, so the authorization callback can't be forged or replayed (CSRF protection).

Every incoming Shopify webhook is verified with a timing-safe HMAC comparison against the shared secret. Requests that fail verification are rejected before any handler runs.

All traffic to and from Retrics is served over TLS. There is no unencrypted path to the application or its APIs.

Shopify access tokens are encrypted at rest with AES-GCM (authenticated encryption) and are never written to logs. They are decrypted only in memory, at the moment a request to Shopify is made.

Customer email, name, phone, and coarse location may be stored for merchant-facing profiles and search, approved sends, and exports. Core retention and lifecycle computations relate orders through internal customer and order IDs, not raw contact fields.

Retrics also stores an irreversible SHA-256 email hash for suppression, audience, and cross-channel matching. Raw contact data is sent to a delivery provider only when a merchant approves an action on that channel.

Production access is restricted to a small number of operators, scoped to what their role requires, and audited. Secrets are held in a managed secret store, not in source control.

Service providers receive only the data needed for their function, and merchant-connected platforms receive data only for the action the merchant chose. We isolate each workspace's store data and publish the supported provider categories on our service-provider page.

Retrics complies with Shopify's Protected Customer Data requirements: we collect the minimum, use it only to provide the service, and don't retain it beyond what the product needs.

We implement Shopify's mandatory compliance webhooks. Verified customers/redact requests run the automated erasure path; shop/redact purges the exact disconnected installation. A customers/data_request delivery creates a count-only receipt and an encrypted case. An authorized owner/admin can compile a current no-store report on demand; Retrics never sends that report automatically.

Paid plans are billed through Shopify's billing system. Card and payment details are handled by Shopify — Retrics never sees, stores, or processes your card data.

We do not sell your data, your customers' data, or any audience derived from it — to anyone, ever. Your store's data is used to run your workspace and nothing else.

Model inputs and outputs from your store are not used to train models for other customers.

We are honest about what is in place today versus what is on the way. The items in this section and the next are commitments in progress, not claims of things already achieved.

SOC 2 Type II is on our roadmap. We are building the control documentation and evidence collection toward a formal audit; we will publish the report here when it is complete, and we won't claim certifications we don't yet hold.

We are expanding automated dependency and secret scanning, tightening access reviews, and formalizing our incident-response runbook. Security is maintained continuously, not treated as a one-time checkbox.

If you believe you've found a security issue in Retrics, please tell us before disclosing it publicly. Email security@retrics.ai with the details and steps to reproduce. We investigate every credible report, act in good faith, and will keep you updated as we resolve it.

Read the privacy policy