Security, data and permissions
What Shopify Connector Pro can read and write, what it stores, and what leaves your instance.
Credentials
- The app's client secret and the access and refresh tokens are encrypted with Fernet using tv_shopify_secret_key from the Odoo configuration file. The key is never stored in the database; a database backup alone does not reveal a credential.
- The encrypted fields are readable only by system administrators, and even then only as ciphertext. The shop form shows a mask. The client secret is write-only.
- Without a key, the connector refuses to store a credential at all.
- OAuth: the callback's state (single use, expires in 10 minutes), shop and HMAC signature are all checked before a code is exchanged. Access tokens expire and are refreshed; refresh tokens last 90 days.
Webhooks
Every delivery's HMAC signature is checked in constant time against the app's secret before anything is stored. Deliveries are deduplicated by Shopify's webhook id; the work is done later by the queue, so the answer to Shopify is fast.
Roles and companies
| Role | Can |
|---|---|
| Viewer | read shops, jobs, events, conflicts, refunds, payouts |
| Operator | import orders and products, retry jobs, resolve conflicts, export contacts/orders/products, cancel orders |
| Accounting operator | map taxes, refund from Odoo, payouts, markets, gateways, profitability |
| Administrator | connect shops and manage credentials, metafield mappings, languages, support bundle, adoption |
Every connector record belongs to a shop and a shop to a company; record rules limit each person to the shops of the companies they work in.
What the connector stores
Shopify ids and names of linked records (orders, lines, variants, products, customers), the values last agreed per synced field, webhook events (the signed body, for audit and replay), job results and attempts, refunds, payouts and their transactions. Customer personal data is stored on Odoo contacts as any sales order stores it.
Retention and removal
- Webhook events and job history accumulate; a connector administrator can delete old ones from their lists when they are no longer needed.
- Uninstalling removes the connector's own tables and fields. Sales orders, invoices, contacts and products created by the connector remain as ordinary Odoo records.
- A Shopify customer data-erasure request is handled in Odoo like any other personal-data request: archive or anonymise the contact.
What leaves Odoo
Only what a feature you turned on sends: stock quantities, fulfillments and tracking numbers, refunds and cancellations you request, and - when exporting - the contacts, orders, products, metafields and translations you choose. The support bundle is created only when an administrator asks and is redacted.