Security
Reviewed 25 August 2026
App security and data access: what to check before you install
The Install button is a data-processing agreement you are clicking through. Scopes, webhooks, and who holds the store-owner password matter more than the screenshot on the App Store card.
Who this is for
Store owners and ops leads who share Admin with agencies and who will be the ones answering a customer data request. This topic sits next to money and identity, so we stick to Shopify’s published rules and do not invent scare stories. This is not legal advice.
Shopify app security starts on the permission screen. Every public app asks for access scopes—read products, write orders, read customers. Those strings are the job description. If a countdown-timer app wants historical orders and customer PII, you are not installing a timer. You are hiring a data processor.
Shopify documents merchant-facing privacy in Help Center and developer obligations in privacy law compliance and protected customer data. You do not need to be an app developer. You need to know what those rules imply when you click Install.
How this was researched
Checked 25 August 2026 against shopify.dev privacy-law-compliance (mandatory webhooks, 48-hour shop/redact, customers/redact delay rules, 30-day completion window) and access-scope docs (minimum access, protected customer data approval). Ranking “is it safe to install Shopify apps” pages are thin; the official webhook table is the part they skip.
Key takeaways
- Read scopes out loud. Match them to the job. A mismatch is a veto or a written exception.
- Apps that touch name, address, phone, or email sit in Shopify’s protected customer data regime. Public apps must be approved for that access.
- App Store apps must implement compliance webhooks:
customers/data_request,customers/redact,shop/redact. - Uninstall triggers
shop/redact48 hours later. Shopify tells developers to complete the action within 30 days unless they are legally required to retain data. - Never share the store-owner login. Staff and collaborator accounts exist so an app vendor does not inherit payouts.
- Uninstall is not complete until app embeds, leftover Liquid, custom app API credentials, and vendor copies of data are accounted for.
Read Shopify app permissions like a contract
On install, Shopify lists permissions in human language. Translate them:
| If you see | Ask |
|---|---|
| View or edit customers / orders | Does a reviews widget need historical orders, or only the current product? |
| Edit theme code / script tags | Why not a theme app extension? Script tags are how leftovers survive. See stack hygiene. |
| View personally identifiable information | Name the processing purpose. If they cannot, do not install. |
| Manage fulfillment or inventory | One system of record. Two writers will desync. |
| Use online store editor / checkout extensions | Which surface—storefront, Thank you, or Plus in-checkout? See checkout apps. |
Shopify’s access-scope documentation tells developers to request only the minimum data required. Use the same standard as the merchant. A marketing pixel app that also wants write access to discounts is expanding its job without asking.
Custom apps you create in Admin or the Dev Dashboard can be worse than App Store apps because they skip public review. A freelancer’s custom app with write_orders and a token in a Slack message is a standing incident. Rotate Admin API tokens when people leave. Do not put tokens in theme files or in a public GitHub repo.
Webhooks are the quiet twin of scopes. An app that subscribes to orders/create will receive order payloads for as long as it is installed. Ask where those payloads live: region, subprocessors, retention. If the privacy policy is a 404, that is the review.
Minimum access
By default, apps do not have protected customer data. Developers request it and, for live stores, must meet Shopify’s data-protection requirements. Unapproved fields come back redacted. For you, the tell is the install prompt talking about customer PII and the listing’s privacy policy.
Protected customer data is a product decision
If you sell to the EU or to California residents, you are typically the controller; the app is a processor. Your privacy policy should name categories of apps (ESP, helpdesk, reviews, fulfillment). The apps below are examples of processors you would list if you use them—not because they are uniquely risky, but because they actually receive profiles.
CCPA/CPRA “do not sell” and marketing consent are easy to break with a second popup app plus an SMS app plus a Facebook app all writing different consent flags. Name one capture layer, as in the year-one stack.
GDPR, CPRA, and the three mandatory webhooks
Shopify requires every App Store app to subscribe to mandatory compliance topics, even if the app claims it stores no personal data. Shopify applies the same webhook pattern regardless of where the shopper lives, then tells developers to consider local law on top. From shopify.dev:
| Topic | What Shopify sends | Timing (Shopify’s docs) |
|---|---|---|
customers/data_request | IDs so the app can help you fulfill a customer access request | When the store owner requests customer data. Apps with customer/order access receive it. |
customers/redact | IDs to delete or redact | If no order in the past six months: 10 days after the deletion request. Otherwise withheld until six months have passed. |
shop/redact | Shop ID and domain so the app can erase that store’s data | 48 hours after you uninstall. |
Shopify also tells developers to confirm receipt with a 200-class response and to complete the action within 30 days, unless they are legally required to retain data. HMAC verification is a developer requirement so fake redaction calls cannot wipe data. You will never see HMAC. You will see whether support can produce a data export when you need one. Test that once on a dummy customer before a peak season, not during a regulator’s clock.
That last webhook is why “we uninstalled it” is not the same as “they have nothing.” Forty-eight hours is the webhook, not your contract. Some vendors keep backups under a legal hold. Read the DPA. When a customer emails you, you still have to ask the vendor; Shopify’s webhook is the automation, not your lawyer.
Staff accounts, collaborators, and the owner login
The store-owner account is for ownership: billing, domain, transferring the shop. It is not a shared password for the intern and the app’s onboarding specialist. Create staff with the least Admin permissions that still let them work. For agencies, use collaborator accounts with a time limit and a named person, not a generic “agency@” inbox.
Some apps add their own user seats. That is a second identity provider. Offboard both: Shopify staff and the app’s dashboard. A helpdesk seat that outlives the contractor is how refunds happen from a laptop that left the company.
Two-step authentication on the owner and on anyone with finance or app-install rights is not optional hygiene. App installs are a privilege; in many stores any staff member who can add apps can add a data pipe. Restrict who can install apps if your plan and staff permissions allow it.
Uninstall leftovers
Same-day uninstall checklist
- Uninstall from Settings → Apps.
- Theme editor → App embeds: confirm gone or disabled.
- Search theme code for the vendor’s snippet names (legacy installs).
- Checkout editor: remove blocks on Thank you / order status.
- Customer events: remove their pixel.
- Custom apps: delete or rotate Admin API tokens.
- Email the vendor for deletion if the DPA requires a ticket, not only the webhook.
- Update your privacy policy processor list if you publish one.
Built for Shopify criteria include a clean uninstall of theme app extensions. That is one reason the badge is a security-adjacent signal, not a marketing trophy. It still does not replace the search through theme.liquid.
Fewer apps means fewer processors. Pair this with stack hygiene. If you are commissioning a private integration instead of a public app, the token story is the whole security model—see build vs buy.
Frequently asked questions
What should I check before installing a Shopify app?
Job, scopes, privacy policy, last update, theme extension vs script tags, who can install it, and whether it overlaps an existing processor. If it needs customer PII, name the purpose and the system of record. If it needs write access to orders or payouts, treat it as a finance decision.
Does uninstalling a Shopify app delete my customer data from the vendor?
Not instantly, and not always completely. Shopify sends a shop redaction webhook 48 hours after uninstall for App Store apps. Developers are told to complete the action within 30 days unless legally required to retain data. Theme leftovers are your problem until you remove embeds and snippets.
Why does a simple app want customer or order access?
Sometimes the feature is real: review requests need an email and an order. Sometimes the app is over-scoped. Ask for the minimum. If the listing cannot explain write access, pick another vendor or a native Shopify tool.
Are custom apps safer than App Store apps?
No. They skip public review and compliance-webhook enforcement that App Store listing requires. A well-built custom app with tight scopes and stored tokens can be fine. A freelancer app with full Admin access in a spreadsheet is worse than a reviewed public app.
What to do next
Shopify app permissions are the cheapest security control you have: read them, match them to a job, and keep a processor list. Then install fewer apps, using the choose-apps protocol.