Curless Storefront — data protection

How this connector prevents data loss · last updated 30 September 2026

The control that does the most work: holding nothing

There is no shopper record in this service to lose. Order lookup reads one order from Shopify, matches it in memory, returns a fixed list of fields, and keeps none of it. No customer table exists, so no customer table can be exfiltrated, mis-backed-up or mis-restored. Every control below protects a much smaller surface because of it.

What is actually held, and how it is protected

• One Shopify access token per merchant. Written to its own file, readable only by the service account, one shop per file. The shop name is validated against a strict allow-list before it is ever used as a filename — a name that fails is refused outright rather than treated as "not installed".
• A product catalogue cache. Public shop data; nothing personal.
• Carts and checkout references, in memory. Variant ids and quantities, and a random reference per checkout — not tied to a person, gone within hours, and never written to disk.
• Per-call logs — tool name, outcome, duration. Never the arguments, so an order number or an email cannot reach a log line.

Limiting what can leave

• The response of every tool is built from an explicit field list, not from the record it came from — a field cannot start being returned by accident.
• Outbound network access is limited to Shopify's own hosts. There is no third-party analytics, telemetry, or error-reporting service to send data to.
• Rate limits bound how much can be pulled through the connector.
• An order lookup answers only when the order number and the email both match, and answers identically when either is wrong — so it cannot be used to confirm that an order exists.

Integrity

• Token writes are written to a temporary file and renamed into place, so a crash mid-write cannot leave a half-written credential that reads as valid.
• Test and production run as separate deployments with separate token stores; neither can read the other's.
• Compliance webhooks are signature-verified before they are acted on.

If something does go wrong

A merchant can revoke access at any moment by uninstalling the app in their Shopify admin; the token stops working immediately and is removed. Suspected exposure of a token is handled by uninstalling and reinstalling, which issues a new one and invalidates the old. Report anything of that kind to ops@curless.ai.

What we do not claim

This service holds no third-party security certification, and says so on the application rather than implying one. It keeps no encrypted off-site backup of shopper data — because it keeps no shopper data.