Security

Effective date: 24 August 2026 · Version 1.1

Read-only by default

Agentic Cart connects to Shopify using read-only OAuth scopes (read_products, read_inventory, read_orders, read_all_orders, read_customers). We do not modify your store, listings, or orders.

Authentication

Merchant sessions use an httpOnly Secure ac_pivot_auth cookie (7-day sliding expiry) issued after Shopify OAuth. OAuth state nonces (5-minute TTL, single use) prevent CSRF during Shopify, Meta, and Google authentication.

Encryption

All connections use HTTPS (TLS 1.2+). The database is encrypted at rest by Supabase. OAuth tokens are stored in the database and readable only by the backend service role. We do not currently apply a second application-level encryption layer on those token columns.

Webhook and OAuth integrity

Every request from Shopify (OAuth callbacks and webhooks) is verified with HMAC-SHA256 before any data is read or written. GDPR compliance webhooks are persisted before we acknowledge them.

Access control

Team roles (Owner, Approver, Viewer) are enforced server-side on store-scoped routes. Approver is not treated as a member on remaining tenant admin APIs. Three failed access attempts in one hour triggers a 24-hour block with owner notification. State-changing actions are recorded in an append-only audit log.

Data minimisation

We do not store customer names, emails, phone numbers, or addresses. Order analytics rows older than 90 days are deleted by a scheduled retention job.

Reporting a vulnerability

Found something? Please email security@agentic-cart.com. We respond within 1 business day.