Security

Effective date: 16 June 2026 · Version 1.0

Read-only by default

Agentic Cart connects to Shopify using read-only OAuth scopes (read_products, read_inventory, read_orders). We do not modify your store, listings, or orders.

Authentication

Sessions use short-lived JWTs (maximum 60-minute validity) stored in httpOnly Secure SameSite=Strict cookies. OAuth state nonces prevent CSRF during Shopify authentication.

Encryption

All connections use HTTPS (TLS 1.2+). Data is encrypted at rest. OAuth tokens and secrets are stored encrypted — not as plaintext.

Webhook and OAuth integrity

Every request from Shopify (OAuth callbacks and webhooks) is verified with HMAC-SHA256 before any data is read or written.

Access control

Team roles (Owner, Approver, Viewer) are enforced server-side on every API request. Three failed access attempts in one hour triggers a 24-hour block with owner notification. All state-changing actions are recorded in an immutable audit log.

Data minimisation

We do not store customer names, emails, phone numbers, or addresses. Order analytics rows older than 90 days are automatically deleted by a scheduled retention job.

Reporting a vulnerability

Found something? Please email security@agentic-cart.com. We respond within 1 business day.