Security & Data Privacy
~6 min readSecurity & Data Privacy
This section documents how dashboardSMASHBOARD is built and operated from a security standpoint — what data is accessed, how it is protected, and what happens to it over time.
How Authentication Works
dashboardSMASHBOARD is a Shopify-embedded app. It never asks for or stores your Shopify account password. All authentication flows through Shopify's OAuth 2.0 system:
- You authorize the app from the Shopify App Store or your admin.
- Shopify issues an access token scoped to the specific permissions the app requested.
- The app stores that token to make API calls on your behalf.
You can revoke access at any time by uninstalling the app from your Shopify admin — this immediately invalidates the token.
Access is governed by Shopify's staff permission system. Any Shopify staff account with the "Manage and install apps and channels" permission can access the app. There are no separate dashboardSMASHBOARD passwords or accounts to manage.
Read-Only Access — The App Cannot Modify Your Store
dashboardSMASHBOARD requests only read permissions from Shopify:
| Permission | Why it is needed |
|---|---|
read_orders |
Revenue, order count, AOV, items sold |
read_reports |
ShopifyQL analytics queries (sales, sessions) |
read_inventory |
Inventory Health card — low stock and critical stock counts |
read_products |
Product names for Top Products breakdowns |
read_customers |
Customer cohort analysis |
No write scopes are requested. The app cannot create, edit, delete, or modify any record in your Shopify store. This constraint is enforced at the Shopify API level.
Data Storage and Hosting
dashboardSMASHBOARD is hosted on Render.com in the United States on managed infrastructure with automated failover and daily backups.
What is stored:
| Data category | What we store | What we do NOT store |
|---|---|---|
| Account data | Store name, store URL, account email | Shopify admin passwords |
| Access tokens | Encrypted Shopify API access token | Plain-text tokens |
| Dashboard data | Dashboard and card configurations (SmashGL queries, goals, settings) | Raw order records or individual customer PII |
| Aggregate metrics | Cached metric values to render dashboards quickly | Individual order line items |
| Notification channels | Webhook URLs, email addresses you add | Customer email addresses from your store |
dashboardSMASHBOARD does not store a copy of your raw Shopify order history, customer records, or product catalog.
Encryption and Transport Security
- In transit: All traffic uses TLS 1.2+ (HTTPS). Render.com manages TLS termination and certificate renewal.
- At rest: The database is managed by Render's PostgreSQL service with encryption at rest. Shopify access tokens are stored encrypted.
- Session cookies:
HttpOnly(inaccessible to JavaScript),Secure(HTTPS only),SameSite=Lax(CSRF protection), and expire after 8 hours of inactivity.
Webhook Verification
Every incoming Shopify webhook is HMAC-SHA256 verified against the Shopify API secret before any payload is processed. Webhooks with an invalid or missing signature are rejected immediately.
GDPR compliance webhooks — the app implements all three Shopify-mandated privacy webhooks:
| Webhook | What it does |
|---|---|
customers/data_request |
Returns any data held for a specific customer |
customers/redact |
Deletes customer data in response to a GDPR erasure request |
shop/redact |
Deletes all store data within 48 hours of an uninstall |
Security Testing Pipeline
| Layer | Tool | What it checks |
|---|---|---|
| SAST | Semgrep with OWASP Top 10 rules | SQL injection, XSS, insecure deserialization, hardcoded credentials |
| Dependency scanning | npm audit |
Known CVEs in all third-party packages — build fails on high-severity findings |
| Secret scanning | Gitleaks (full git history) | Accidentally committed API keys, tokens, or passwords |
| Security test suite | Dedicated test kit | Rate limiting, HMAC verification, timing-safe comparisons, TOTP logic |
| Weekly scan | Scheduled CI run | Re-runs all of the above every Monday to catch newly disclosed CVEs |
Public Share Links
Shared dashboards use a unique URL token to control access. The URL itself is the credential — anyone with the exact URL can view the read-only dashboard; anyone without it cannot.
Security properties:
- Read-only: Recipients can view data but cannot edit cards, goals, or settings
- No Shopify login required
- Expiry controls: Links expire after 7, 30, or 90 days, or never — see Sharing & Exporting
- Instant revocation: Toggle the link off in the Share modal to immediately invalidate it
Data Retention and Deletion
| Event | What happens |
|---|---|
| Active account | Dashboard configurations, goal history, and cached metrics retained while the account is active |
| Uninstall | Data deletion begins within 30 days; customer-linked data deleted within 48 hours via shop/redact webhook |
| Backup purge | Database backups purged on a 90-day rolling schedule |
| GDPR / PIPEDA request | Data subject access and erasure requests honored within 30 days |
Compliance and Regulatory Summary
| Standard | Status |
|---|---|
| GDPR (EU) | Compliant — EU/UK data transfers under Standard Contractual Clauses (Art. 46); mandatory privacy webhooks implemented |
| PIPEDA (Canada) | Compliant |
| Shopify App Store requirements | All mandatory privacy and billing webhooks implemented and verified |
| Breach notification | Affected merchants notified within 72 hours of a confirmed breach |
| Data sales | We do not sell, rent, or trade your data. Ever. |
For the full privacy policy, see dashboardSMASHBOARD Privacy Policy.
Still need help?