Security is part of the product architecture, not a badge added later. ShopDash is designed to minimize access, ground responses in merchant-authorized data, and make sensitive automation reviewable.
Platform safeguards
- Encrypted transport. Production traffic uses HTTPS through Cloudflare, and supported provider connections use encrypted transport.
- Separated secrets. Application credentials are stored as encrypted deployment secrets and are not shipped to browser code or committed to source control.
- Managed data services. Production application records are stored in Supabase Postgres with controlled service access.
- Operational visibility. Server errors and deployment events are logged to support incident investigation without intentionally exposing secrets.
Shopify access
ShopDash uses Shopify OAuth and requests only scopes required by enabled functionality. The private beta currently requests read access to products, inventory, and content. Access tokens are stored server-side. Uninstall and mandatory privacy webhooks are implemented.
AI safety model
- Responses are designed to reference approved store knowledge rather than rely only on general model memory.
- Source references and confidence signals are preserved for review where supported.
- Actions have explicit risk levels. Sensitive operations require merchant approval before execution.
- Audit events provide a record of what was proposed, approved, and executed.
Data handling
We do not sell merchant or customer data. We limit retention to service, legal, and security needs and process Shopify privacy webhooks. Service providers are listed on our Subprocessors page.
Responsible disclosure
If you believe you found a vulnerability, email security@shopdash.ai with the affected endpoint, reproduction steps, and potential impact. Please avoid accessing data that is not yours, disrupting service, or publicly disclosing an issue before we can investigate.
Current status
ShopDash is in private beta. We do not claim SOC 2, ISO 27001, PCI DSS, or other independent certification at this stage. We will update this page as controls and third-party assurance mature.