Trust center
Safe by design at the checkout boundary.
The runner is powerful enough to use a storefront, so its permissions and stopping conditions are intentionally narrow.
Read-only platform access
The BigCommerce app requests store_v2_information_read_only. ShopPath does not request order, customer or payment write access.
No transaction authority
ShopPath never submits payment, places an order or enters real customer details. A visibly rendered checkout start is terminal evidence.
Storefront access
Each storefront needs approval before testing. If an access challenge prevents the journey from continuing, the report records the blockage rather than claiming the checkout path passed.
Isolated execution
Storefront journeys run in a separate, authenticated service. Customer dashboard traffic never receives internal service credentials.
Evidence access
Workspace reports are private by default. Authorized members can create expiring share links and revoke them at any time. Anyone with an active link can view that shared report without signing in, so customers should send links only to intended recipients. Screenshots and recordings use short-lived signed URLs; raw diagnostics remain private.
Report a security concern
If you believe ShopPath data or an account may be at risk, email support@getshoppath.com. Our machine-readable disclosure contact is published at /.well-known/security.txt.
Service availability
Current public availability is shown on the ShopPath status page. Internal APIs, queues and browser runners are monitored privately and are not exposed as public infrastructure details.
Security posture
ShopPath is not currently represented as SOC 2 certified or independently penetration tested. Security questionnaires, data-processing terms and current architecture details are available during onboarding. We will update this page only after an independent status has actually been obtained.