Security

LAST UPDATED: 3 NOVEMBER 2026

1. How access works

CheckoutLeak is an embedded Shopify app. When you install it, Shopify shows you the permissions listed below and asks you to approve them. The app then receives an access token for your store through Shopify’s own install and token-exchange flow. We never see your Shopify password.

Inside Shopify admin, the app’s pages authenticate every request with a short-lived session token issued by Shopify. Store access tokens are expiring tokens, kept in our database and used only by our servers. When you uninstall the app, they are deleted straight away.

2. Permissions we ask for

We ask only for what a shipped feature needs. Write permissions are used only for changes you approve or Autopilot rules you switch on.

PERMISSION	WHY WE NEED IT
`read_discounts`	Scan your discounts for problems such as risky stacking, selling below cost or missing limits, and notice when a discount is created or edited.
`write_discounts`	Apply discount fixes you approve, an alert pause you confirm or an Autopilot rule you enabled, and undo them.
`read_orders`	Leak Radar: turn orders into daily totals per discount code. Our order query does not ask Shopify for any customer fields.
`read_products`	Read products, variants, prices and costs, so we can check the margin on what each discount applies to.
`write_products`	Apply product fixes you approve: prices, compare-at prices, stock and overselling settings, alt text, search text and descriptions.
`write_publications`	Publish or unpublish a product on your sales channels when you approve it.
`write_pixels`	Add the optional storefront insights pixel, only when you turn storefront insights on.
`read_customer_events`	Required by Shopify for that pixel to receive storefront events. We reduce them to anonymous daily counters.

3. Read-only scans, changes only with your approval

Scans only read your store. They never change anything.
Discounts and products change only through a fix you approve, an alert pause you confirm, or an Autopilot rule you switched on, within the limits you set.
After a change, CheckoutLeak checks the result in Shopify, records it in your store’s audit trail and lets you undo it from the app.

4. Signed webhooks and links

Webhooks. Every webhook from Shopify (uninstalls, permission updates, discount changes and privacy requests) is checked against Shopify’s HMAC signature before we act on it. Unsigned or altered requests are rejected. Each delivery is recorded so a retry can never be applied twice.
Alert pause links. The one-tap pause link in an alert is signed by our server, expires after 48 hours, works only once and can pause only the one discount it names. Opening it shows a confirmation page; nothing changes until you confirm, so email link scanners can’t pause anything. The pause is logged and can be undone in the app.
Storefront pixel. Our collector only accepts events that carry your store’s pixel key. We store only a hash of that key, and each store has a daily event limit.
Waitlist. Sign-ups are rate-limited per sender using a one-way, keyed hash of the IP address, never the address itself.

5. We keep as little as possible

Orders are reduced to daily totals per discount code. Individual orders are not stored.
We store no customer names, emails, phone numbers or addresses.
Storefront activity is kept as anonymous daily counters. A discount code a shopper typed that was rejected is kept only as a keyed hash.
Your store’s owner email is read from Shopify when a summary or alert is sent, and is not stored.
Application logs carry IDs and counts only.
Everything has a retention limit. See how long we keep data.

6. Hosting and the database

The app runs on Vercel, with its functions in Dublin, Ireland. The production database is Supabase PostgreSQL in London, UK. Background jobs run on Trigger.dev and email is sent through Resend. The full list is on our subprocessors page.
Data is encrypted in transit (TLS) and encrypted at rest by our database provider.
Only our servers connect to the database. Its public data API is switched off, the public API roles have no access to any table, and row-level security is enabled on every table.
Secrets such as API keys and signing keys live in our hosting providers’ environment settings, never in our code.

7. AI processing

AI suggestions are optional. When they are on, only product images and text, and the numbers in your weekly summary, are sent to write suggestions. Requests go through OpenRouter and are routed only to model providers that do not store request data or train on it. No customer data is sent. You approve every AI-written change, unless you let an Autopilot rule act. Details are in our privacy policy.

8. Deletion

When you uninstall, your store’s access tokens are deleted and our access ends immediately.
About 48 hours later, Shopify sends a data erasure request (shop/redact). We then delete everything stored for your shop. The only record we keep is that the erasure happened: your shop domain and the time.
Customer data requests from Shopify are acknowledged and recorded. We hold no customer personal data, so there is nothing to return or delete.

9. What we don’t claim

CheckoutLeak is a young product. We don’t hold formal security certifications such as SOC 2 or ISO 27001, and we don’t offer an uptime guarantee. This page describes what we actually do. If your team needs more detail for a security review, email support@checkoutleak.com.

10. Reporting a security issue

If you think you have found a vulnerability, email support@checkoutleak.com with the subject “Security”. Please include what you found, how to reproduce it and the affected page or store. We will acknowledge your report and keep you updated as we look into it, as soon as we can.

Please test only against stores you own or are authorised to test, don’t access or change other merchants’ data, and give us reasonable time to fix the issue before you share it publicly. We don’t currently run a paid bug bounty.

Read-only scans.

Verified and undoable.

Minimal by design.

What we don't claim.