Resources · Security & trust

What Scout can touch, what it can't, and how each is enforced.

This page is written for the people who have to check it — channel reviewers, marketplace application teams, and merchants deciding whether to install. It lists specific, verifiable controls. It does not list certifications, because Scout holds none, and it does not describe a security team, because Scout is a sole proprietorship.

Shopify accessRead-onlyNo write scope is requested or held.

Shopper personal dataNone storedStripped before storage; build fails otherwise.

Tenant isolationPer store, at the databaseVerified by automated tooling on every change.

Payment card dataNever seenAll billing runs through Shopify.

The controls, one by one

01 · Access scopeRead-only access to your Shopify catalog.

Scout requests read scopes for products, variants, inventory, and basic store details. It requests no write scope of any kind, so it cannot create, edit, or delete products — and a fault in Scout cannot alter your store. Order access is optional, requested only when you enable Conversion Intelligence, and revocable in your Shopify admin.

How it's enforcedShopify enforces the scope list at the API. The scopes Scout requests are visible on the install screen and in your admin under Apps.

02 · Personal dataNo shopper personal data is collected.

Scout stores no customer names, emails, addresses, phone numbers, or IP addresses. When order data is ingested, personal fields are removed before the record is written — not scrubbed afterwards. The join between orders and analytics uses product identifiers only.

How it's enforcedAn automated schema test runs in the build pipeline. If a personal field appears in the order schema, the build fails and the change cannot be deployed.

03 · Tenant isolationEvery record belongs to exactly one store.

Every table carries a store scope, and every query is constrained by it at the database level. One merchant's data is not reachable from another merchant's session, by design rather than by convention.

How it's enforcedAutomated tooling verifies the scope constraint on every change to the data layer; a query path that could cross stores fails the check.

04 · CredentialsChannel credentials are encrypted at rest.

OAuth tokens and, for Walmart, pasted API keys are encrypted before storage. Encryption keys are held in Google Cloud Key Management Service, not in application code or configuration. Disconnecting a channel deletes its credential.

How it's enforcedKeys never leave Cloud KMS; the application requests decryption at use time and holds plaintext only in memory for the duration of the call.

05 · Data rightsShopify's three privacy webhooks, with real export and erasure.

customers/data_request, customers/redact, and shop/redact are implemented and handled automatically. On uninstall, all operational data for the store is deleted when Shopify's erasure request arrives (~48 hours later). Any merchant can request an export or erasure by email.

How it's enforcedWebhook handling is part of the app's Shopify review. The uninstall timeline is documented step by step on GDPR & Data Rights.

06 · PaymentsScout never sees payment card details.

All charges are made through Shopify's billing system and appear on your Shopify invoice. Scout receives the plan selected and a charge confirmation, nothing more. There is no card form anywhere in Scout.

How it's enforcedThere is no payment code path to secure: Scout has no integration with a card processor.

07 · RetentionRaw third-party API responses are kept 30 days at most.

Unprocessed replies from channels and other APIs are retained for debugging for a maximum of 30 days, then deleted automatically. Catalog mirror, feed history, and diagnostics are kept while you're installed and deleted on erasure.

How it's enforcedA scheduled job deletes raw responses older than 30 days. Retention for every other record type is listed in the Privacy Policy.

Infrastructure and sub-processors

Where it runs, and who else touches product data.

Only product and store data leaves Scout; shopper personal data cannot, because Scout never holds it. Each recipient processes what it receives under its own terms.

HostingGoogle Cloud Platform · us-east1 (South Carolina, US)

Key managementGoogle Cloud Key Management Service

Sales channelsOnly the ones you connect · your feed data

Marketplace taxonomy APIsAmazon, Walmart, eBay · product identifiers

Competitive price dataSearch API provider · public shopping listings looked up by product title and GTIN · no customer data · raw responses deleted within 30 days

RecommendationsAI model provider · product titles, descriptions, attributes and price signals · no customer or order data · not used to train models

BillingShopify · plan and charge status only

What this page does not claim

No certifications. No audit badges. Said plainly.

Scout holds no SOC 2, ISO 27001, HIPAA, or PCI certification, has not commissioned a third-party penetration test, and runs no bug bounty. It is operated by one person. If any of that changes, this page will say so — with the report, not a badge.

If you find a security issue, email security@meerkatscout.com with steps to reproduce. It reaches the person who can fix it.

Put Scout on watch

Ready to put Scout on watch?

Connect your Shopify store and see the state of every feed, channel, and product from one place.

Start your 14-day free trial Book a demo

No card required. Scout never edits your Shopify products.