How it works
Security and product overview for merchants
Checkout Firewall asks Shopify’s checkout validation to reject a match. It does not call a payment processor, and a webhook detection is not proof the payment was refused.
Compile, don’t call out
Your lists, mode, and hashed reputation signals are compiled into a Cart & Checkout Validation Function payload. Shopify runs that Function at checkout. The Function does not open network calls to our servers during the buyer’s checkout.
What never enters the App
- Payment card numbers (PAN)
- CVV / CVC
- Full magnetic stripe or wallet secrets
We work with checkout identity (email, phone, address, postal, customer id when present) and merchant configuration only.
Shop isolation
Blacklists, whitelists, reports, and Activity are shop-local. Shared reputation stores HMAC hashes, not raw identity. Another merchant cannot browse your customers, and you cannot see theirs.
Card-testing observation
Checkout webhooks help detect burst patterns typical of card testing. Hot identities can be compiled into enforcement according to your mode and rules. Attacks and Activity surfaces explain what fired.
Modes
- Monitor — record would-blocks; never stop checkout (default).
- Balanced — block high-confidence matches.
- Aggressive — stricter thresholds under active attack.
Compliance webhooks
The App implements Shopify mandatory webhooks for customers/data_request, customers/redact, and shop/redact, plus uninstall cleanup. Details live in the privacy policy.