Security

Security approach

OrderDraft keeps Shopify authentication and session handling inside the official Shopify React Router app foundation.

• Every embedded route is authenticated by Shopify admin session.
• Merchant-owned records are scoped by authenticated shop.
• Uploaded source files are stored privately and opened by signed URL.
• Uploaded files are checked against supported type signatures.
• Upload size is limited to 25 MB by default.
• Secrets are read from server-side environment variables.
• Draft orders require explicit merchant confirmation.
• Failed private-object deletion is persisted for retry.

This page does not claim third-party certifications or guaranteed compliance status.

Report a security concern

Please avoid including purchase-order contents, credentials, or other sensitive data in the first message. If configured, use the dedicated privacy and security contact: privacy@clintelio.com.