PortfolioAbout This Topic
One of the most important design decisions in headless EC development is "where to store customer data." This project adopted the policy of storing all customer data in Shopify and not storing any data on our own servers.
This is not just a technical choice, but a strategic decision derived from security, legal liability, and operational cost perspectives.
Why This Design Decision Matters
When operating an EC site, customer data management is an unavoidable challenge. Traditionally, the mindset that "storing data internally is standard" was mainstream, but this comes with more risks and costs than imagined.
Risks of Internal Storage
| Risk | Specific Content |
|---|---|
| Security responsibility | Legal liability and damages in case of data breach |
| Operational costs | Security audits, vulnerability response, backup management |
| Personal data protection law compliance | Purpose disclosure, access requests, deletion requests |
| PCI DSS compliance | Strict standards when handling credit card information |
Benefits of Storing in Shopify
| Benefit | Details |
|---|---|
| Delegated security | Shopify maintains world-class security |
| Distributed legal liability | Shared responsibility with Shopify as data processor |
| Cost reduction | No investment in security infrastructure required |
| Reliability | Track record and trust of a major platform |
Basic Design Principles
Your server (Vercel, etc.) only temporarily processes customer data and does not store it persistently. Authentication and session information are also managed with minimal validity periods.
Submit data via registration or my page updates
Temporary processing only. Validation and API calls. Data is not stored
Persistent storage. Customer data protected under world-class security management
For Those Who Want to Learn More
This design philosophy is explained in detail in three articles.
1. Security and Shared Responsibility
Detailed explanation of why not to store customer data internally, from security and legal liability perspectives.
-> Security and Shared Responsibility
2. Passwordless Authentication
Explanation of authentication concepts in headless architecture and passwordless authentication implementation approaches.
-> Passwordless Authentication
3. Utilizing Metafields
How to manage additional information needed for Japanese EC sites, such as furigana and birthdate, using Shopify metafields.
What This Design Enables
For Operations
- Significantly reduced security response costs and effort
- Minimized data breach risk
- Reduced burden of personal data protection law compliance
For Customers
- Personal information protected by world-class security
- Easy and secure passwordless login
- Consistent customer experience across all channels