Ecommerce Data Security Best Practices
Your customer database is probably the most sensitive asset your business holds. Names, email addresses, physical addresses, purchase history, phone numbers - and depending on your payment setup, the last four digits of card numbers and billing details. Attackers want this data because it is immediately useful: sell it on criminal marketplaces, use it for targeted phishing, exploit it for account takeover attacks on other services where the same email address appears, or combine it with other datasets for synthetic identity fraud.
Customer data protection in ecommerce is a layered discipline - not through a single control, but through practices that reduce exposure at every point where data is collected, stored, transmitted, or accessed. This guide covers the practical operational controls that matter most for stores at every scale.
This guide focuses on data security specifically - for the full framework including fraud, compliance, and AI monitoring, see the Ecommerce Security & Compliance Complete Guide.
See it in action
Want to automate this for your store?
VortexIQ's AI agents can audit, fix, and monitor your ecommerce store automatically.
In This Guide
Why Customer Data Is Your Most Valuable, and Most Targeted, Asset
Understanding why your data is targeted helps calibrate which protections matter most.
A customer record from an ecommerce store is more valuable to an attacker than a generic username/password pair because it is rich. An ecommerce customer record typically contains: full name, delivery address (often the home address), email address, phone number, purchase history (which reveals income level, interests, household composition), and in many cases loyalty or account information. This combination is valuable for:
Credential stuffing attacks on other services: The email address and password (even if hashed) from your store is tested against banking apps, other retail accounts, and subscription services. Password reuse across services is common enough that a significant proportion of these attempts succeed.
Targeted phishing: A customer who recently ordered from your store can be sent a highly convincing phishing email that references their recent order, creates urgency, and harvests their banking credentials or personal information.
Address-based fraud: Verified delivery addresses are used by fraudsters to place orders on other platforms using stolen payment methods, shipping to addresses they know are valid.
Data brokers and dark web marketplaces: Bulk customer records are bought and sold. The value per record increases with the richness of the associated data.
None of this requires a sophisticated attack. A poorly secured admin account, an outdated plugin with a known vulnerability, or a third-party app that turns out to be malicious is sufficient. Ecommerce data security is about reducing the probability and impact of each of these scenarios.
Principle of Least Privilege: Your Admin Access Model
The most commonly overlooked data security control in ecommerce is access management. Every account with admin-level access to your store is a potential entry point. The principle of least privilege means each person has access only to what they need for their specific role, and nothing more.
Map Your Current Access
Before you can apply least privilege, you need to know your current state. List every person (employee, contractor, agency, freelancer) who has any level of access to:
- Your ecommerce platform admin panel
- Your email marketing platform
- Your customer support system
- Your analytics tools
- Your payment processor dashboard
- Your fulfilment system
For each person, document what access level they hold and what they actually need for their day-to-day work. You will almost certainly find mismatches: people with admin access who need read-only, people who no longer work with you who were never removed, and agency accounts from previous relationships that remain active.
Role-Based Access in Practice
Shopify, BigCommerce, and Adobe Commerce all provide role-based permission systems. Use them:
- Customer service staff: access to orders and customer records, no access to financial settings or admin account management
- Marketing team: access to customer segments and discount code creation, no access to order fulfilment or platform configuration
- Developers and agencies: limited access scoped to their specific project, removed when the project ends
- Finance: access to financial reports and payout settings, no access to customer data beyond what is necessary for their role
The admin account should be held by the fewest people possible - ideally one or two named individuals who own the security responsibility.
Offboarding: Remove Access Immediately
Delayed access removal is one of the most consistent findings in post-breach investigations. When staff leave or a contractor engagement ends, remove their access to every system the same day. This is not a bureaucratic nicety - a dormant account from a departed employee with unresolved grievances, or simply a forgotten login that gets phished, is a real and preventable risk.
Build access removal into your offboarding process as a required step, not an afterthought.
Encryption: What Is Protected and What Is Not
Encryption is a frequently mentioned security control that is also frequently misunderstood. Here is what actually applies to an ecommerce store.
Encryption in Transit (TLS/HTTPS)
All data moving between your customer's browser and your store should be encrypted via TLS - this is what the padlock icon in the browser address bar confirms. Modern ecommerce platforms enforce HTTPS on all store pages by default. Where you need to verify this yourself is on:
- Custom domains and subdomains you have configured
- Staging environments (which often operate without TLS by default)
- Any custom checkout or payment pages that sit outside the main platform
- API connections between your store and third-party services
An unencrypted HTTP connection anywhere in the customer session is a potential data exposure point. Check every environment, not just your main store URL.
Encryption at Rest
Data stored in your platform's database is encrypted at rest by Shopify, BigCommerce, and Adobe Commerce's cloud infrastructure by default. You do not need to configure this for data held within the platform. Where you do need to consider encryption at rest:
- Any local exports of customer data (CSV files, spreadsheets) saved to devices or shared drives
- Third-party analytics or reporting databases that store customer data
- Email marketing platforms and CRM systems that import your customer data
- Any custom database or data warehouse you maintain outside the ecommerce platform
These are the locations where customer data is frequently stored in plain text without the platform's built-in protections.
What Encryption Does Not Protect Against
Encryption protects data in transit from interception and data at rest from raw file access. It does not protect against:
- A compromised account with legitimate access credentials (encryption does not prevent an authorised attacker)
- Data that is decrypted and exported by a legitimate user (encryption does not prevent authorised export)
- A breach through an application vulnerability that accesses data through the application's own encrypted read path
Encryption is necessary but not sufficient. Access controls and monitoring complete the picture.
Third-Party App Risk: Your Data Leaves Your Store
This is the data security risk most consistently underestimated by ecommerce store owners.
Every app installed on your store that accesses customer data is, under data protection law, a data processor. Under GDPR, you are required to have a written data processing agreement with each processor. More immediately from a security standpoint, each app represents a data access point that you did not build and may not fully understand.
What App Permissions Actually Mean
When an app requests permission to read your customers, it is requesting access to your customer database - names, email addresses, addresses, purchase history. When it requests permission to read and write orders, it can both read your order data and create or modify orders in your store. These are significant data access grants, and they persist for as long as the app is installed.
The security question to ask before installing any app: Does this app need this level of access to do what it claims to do? A pop-up upsell app that needs full customer read access to display an offer at checkout may have a legitimate reason for that access - or may not. If the permission scope seems disproportionate to the feature, check the developer's documentation or contact them before installing.
Supply Chain Risk: App Acquisitions and Compromises
A risk that has increased in frequency: legitimate apps with good reputations being acquired by new owners who subsequently modify the app code to include data harvesting functionality. The original developer's track record does not protect against changes made by a new owner.
Check app update history - an app that has had unusual update frequency or a change in ownership is worth scrutiny. Platform security teams do review apps, but not every malicious modification is caught immediately.
Regular App Audits
Conduct a periodic audit of every installed app:
- Is this app still in active use? (Remove anything that is not)
- What permissions does it currently hold?
- When was it last updated?
- Is the developer still actively maintaining it?
- Have there been any security reports or unusual reviews in the marketplace listing?
For apps you keep, verify that data processing agreements exist (required under GDPR for EU/UK customer data).
Secure Ecommerce Data Handling Practices
Beyond the system-level controls, the day-to-day practices your team follows determine whether customer data is actually protected.
No Card Data, Anywhere
This is the foundational PCI DSS requirement: do not store card data. Not in your platform database, not in a spreadsheet, not in a customer support ticket, not in a shared document. If any part of your operations involves manually recording card details - for phone orders, for example - this needs to stop. Use a payment processor's virtual terminal for phone payments; never write down or type card numbers into anything other than the authorised payment system.
If your platform uses hosted payment forms (Shopify Payments, Stripe Elements, PayPal), card data never reaches your systems in the first place. This is the safest architecture.
Transactional Email Security
Customer transactional emails (order confirmations, shipping notifications, account creation emails) contain customer data. Ensure your email sending infrastructure uses DKIM and SPF authentication - this both protects your customers from email spoofing and helps ensure your legitimate emails land in inboxes rather than spam.
Do not include more customer data in emails than is necessary. An order confirmation does not need to include the customer's full date of birth, complete phone number, or any information beyond what is needed to confirm the transaction.
API Key Storage
If your store uses API connections to third-party services (fulfilment partners, analytics tools, customer data platforms), those connections are authenticated with API keys. API keys are credentials - treat them with the same care as passwords. The OWASP API Security Top 10 identifies insecure API key handling and excessive data exposure as among the most common API vulnerabilities.
Do not include API keys in code that is committed to version control repositories. Do not share API keys over email or chat. Rotate API keys when staff who had access to them leave. Use the minimum permission scope when generating API keys - a read-only key for an analytics integration should not have write permissions.
Staff Password Policies
Enforce strong passwords and 2FA across all admin accounts. Consider a password manager (1Password, Bitwarden) for your team - password managers make strong, unique passwords per service practical without placing the cognitive burden of memorisation on your staff. Shared login credentials (multiple people using the same admin account) should be replaced with individual accounts so that access can be granularly controlled and access events can be attributed to specific users.
Ecommerce Data Security Checklist
Control What It Protects Against How to Verify Notes HTTPS on all pages and environments Data interception in transit Check every URL including staging and subdomains Most hosted platforms enforce this; verify for custom domains 2FA on all admin accounts Admin account takeover Check account security settings in each platform Mandatory, not optional Admin access reviewed and role-appropriate Insider threat, account compromise Audit permissions list quarterly Remove departed staff same day App permissions audited Third-party data exposure Review installed apps list Remove unused apps No card data stored PCI DSS compliance, payment fraud Verify with payment processor setup Use hosted payment forms API keys scoped and secured Integration compromise Review active API keys and their permission levels Rotate annually and on staff departure Data processing agreements with third-party processors GDPR compliance Check DPAs for all apps and services with customer data access Required under GDPR for EU/UK customers Customer data export controls Bulk data exfiltration Review who can run customer exports Restrict to named individuals Staff security training current Phishing, social engineering Training records Annually + before peak trading Backup current and tested Data loss, ransomware, breach recovery Verify last backup date and test restore Untested backups are not reliable
Backup as a Data Security Control
Backup is typically discussed as a business continuity tool - the thing that protects you from accidental data loss. It is also a security control, and an important one.
The scenarios where backup is your most critical data security asset:
Ransomware and destructive attacks: An attacker who encrypts your data or deletes it loses their hold over you if you have a clean, recent backup to restore from. Without backup, the choice is pay the ransom or rebuild.
Data corruption from a compromised integration: A malicious app or a bad data import can corrupt your customer database. A point-in-time backup lets you restore to the state before the corruption without losing the rest of your data.
GDPR data portability requests: A customer requesting all their personal data under GDPR needs the complete history of their interaction with your store. If your backup does not retain this data reliably, you may be unable to fulfil the legal obligation.
Breach recovery: After a confirmed breach, restoring systems to a clean state requires a backup taken from before the compromise. Without it, you are attempting to clean an infected system - harder, less reliable, and more time-consuming.
Vortex Apps provides encrypted automated backups for Shopify and BigCommerce stores - point-in-time backups that run automatically, are encrypted at rest, and can be restored to a specific date. For store owners who rely on platform-native export as their "backup", it is worth noting that a manual CSV export is not a backup: it does not capture all data types, does not maintain relational integrity, and requires the store to still be functional to run.
Frequently Asked Questions
What customer data is an ecommerce store legally required to protect?
All personal data you collect about customers is subject to data protection obligations under GDPR (for EU/UK customers) and CCPA (for California customers). This includes names, email addresses, physical addresses, phone numbers, purchase history, browsing behaviour (if tracked), and any other information that can identify a specific individual. "Protecting" it means ensuring it is processed lawfully, stored securely, not retained longer than necessary, and not shared with third parties without appropriate legal basis.
How do I know which apps have access to my customer data?
In Shopify, go to Settings > Apps and sales channels, then select any installed app to view the permissions it holds. In BigCommerce, admin permissions for installed apps are visible in the Apps section of the control panel. For each app, you will see a list of what it can read and write. If an app has access you cannot explain by its function, contact the developer or remove the app.
Is HTTPS enough to protect customer data?
HTTPS encrypts data in transit between your customer's browser and your server. It is necessary but not sufficient on its own. It does not protect against: a compromised admin account accessing your database from an authorised session, a malicious third-party script running on your page (HTTPS does not verify the legitimacy of scripts, only that the connection is encrypted), data that is exported from your platform and stored insecurely, or vulnerabilities in your application code that allow unauthorised database access through the application layer.
How long should I keep customer data?
Under GDPR, data should not be retained longer than necessary for the purpose for which it was collected. For most ecommerce stores, transaction data (orders, addresses, payment records) needs to be retained for tax and legal compliance purposes - typically 6-7 years in most jurisdictions. Marketing data (email preferences, consent records) should be reviewed and cleaned regularly - contacts who have not engaged for a defined period (typically 12-24 months) should be suppressed or removed unless there is a specific reason to retain them.
What is the difference between data security and data compliance?
Data security is the technical and operational practice of protecting data from unauthorised access. Data compliance (GDPR, CCPA, PCI DSS) is the legal and contractual requirement to meet specific standards in how you collect, process, store, and protect data. They overlap significantly - many compliance requirements mandate specific security controls - but they are distinct. You can have strong data security practices and still be non-compliant (e.g., by not having a valid lawful basis for processing under GDPR). You can be technically compliant on paper and still have poor security practices. Both matter.
Related Articles
- Ecommerce Security & Compliance: Complete Guide
- Ecommerce Security 101: Threats Every Store Faces
- GDPR Compliance for Ecommerce: What You Must Know
- Ecommerce Data Breach Response Plan
- Ecommerce Backup & Data Protection: Complete Guide
- Ecommerce Monitoring & Anomaly Detection: Complete Guide
Ready to take action?
Run a Free AI Audit on Your Store
VortexIQ scans your ecommerce store across 85+ checks — SEO, performance, analytics, ads — and gives you a prioritised fix plan in under 30 seconds.