Security

Security approach

PO to Draft keeps Shopify authentication and session handling inside the official Shopify React Router app foundation.

• Every embedded route is authenticated by Shopify admin session.
• Merchant-owned records are scoped by authenticated shop.
• Uploaded source files are stored privately and opened by signed URL.
• Uploaded files are checked against supported type signatures.
• Upload size is limited to 25 MB by default.
• Secrets are read from server-side environment variables.
• Draft orders require explicit merchant confirmation.
• Failed private-object deletion is persisted for retry.

This page does not claim third-party certifications or guaranteed compliance status.