Security & data handling

For the CTO, engineering lead, or security reviewer evaluating Subscription Concierge.

Built on Shopify, not beside it

• Native subscriptions. Every subscription is a Shopify subscription contract, and renewals are charged by Shopify against the payment method the customer saved in Shopify. Full card numbers never reach our systems.
• No theme code edits. Storefront pieces are theme app blocks placed in Shopify's theme editor. Removing the app removes them cleanly.
• No separate shopper login. Storefront requests come through Shopify's App Proxy and are verified by Shopify's signature, so subscribers never create another account.
• Current Shopify API. The app runs on Admin API version 2026-10.

Permissions requested

Installation is a standard Shopify OAuth flow. The app requests read/write access to products, orders, and subscription contracts. For protected customer data it requests only name and email address, reads them from Shopify when needed, and doesn't store them. It doesn't request phone numbers or addresses. Your Shopify staff login is the dashboard login; there's no separate password.

Protecting your data

• Encryption in transit (TLS everywhere) and at rest. Shopify access tokens are additionally encrypted before they're stored.
• Backups run daily, are encrypted, and are kept for 7 days.
• Restricted production access: named administrators only, with multi-factor authentication and logged infrastructure activity. The database isn't reachable from the internet.
• Multi-tenant isolation. Every record is scoped to one shop, and one merchant's data is never visible to another.

Controls for your team

• Roles. Admin (full read/write) and Viewer (read-only).
• Staff access log. Every time someone on your team views or changes a customer or subscription record, including bulk actions and imports, it's logged (who, what, when) and visible to your admins.

Retention and privacy requests

• Retention. Canceled-subscription history and access-log entries are purged after 365 days, and subscription-import files after 30 days.
• Shopify's privacy webhooks (customers/redact, customers/data_request, shop/redact) are implemented and signature-verified, so customer erasure and data requests made through Shopify reach us automatically.
• Uninstalling deletes your store's data as described in the privacy policy.

The Data Processing Addendum covers GDPR and US state privacy terms and lists our sub-processors.

Requirements

• A Shopify store on any plan. Checkout upsells need Shopify Plus; everything else works on every plan.
• The customer account Subscriptions page needs Shopify's new customer accounts.

Security questionnaires

Send security questionnaires or architecture questions to hello@subscriptionconcierge.com. For integrations, see the API docs.