AccountSecurity
How it works
How your data is protected
In short
VendorDue reads your Shopify orders and products but can't change them, and drops customers' names and addresses before saving anything. Vendors' contact and payout details, messages and files are encrypted with your store's own key. Each vendor sees only their own records, and VendorDue's team never sees individual orders or what one vendor is owed.
Your vendors trust you with their payout addresses, and you're trusting VendorDue with them. This page is what happens to that information, in plain words. The full detail is in the security page, the privacy policy and the data processing addendum.
What VendorDue reads and keeps#
From Shopify, it reads orders, products and reports, and nothing else. It can't change your store, your products or your customers.
Settings, then Data and privacy lists the rest:
- What it stores for this shop: "Order effects, payout calculations, vendor contacts, each vendor's PayPal or Venmo address (sealed), and support threads."
- What it never stores: "Customer identity, bank or card numbers, and any Shopify access beyond reading."
Every Shopify order arrives with the customer's name, email and address. VendorDue keeps what was bought and for how much, because a vendor's share is worked out from it, and drops who bought it before anything is saved. So a vendor's payout line shows Order #1047, never a customer.
Locked with your store's own key#
Your store has its own key, and these are encrypted with it before they're saved:
- Names and email addresses of your team, your vendors and their contacts.
- Each vendor's PayPal or Venmo address, and your PayPal connection.
- Messages, notes, reasons and attached files.
Amounts, product titles, order numbers and the vendor names on your products aren't, because VendorDue adds them up, searches them and shows them in every list. Vendor names are already public on your storefront.
Who sees what#
| Who | What they see |
|---|---|
| Your Admins | Everything. A vendor's full payout address only in a download, after confirming it's them |
| Your Viewers | Everything, with payout addresses shortened, like Venmo •••• 0123 |
| Each vendor | Their own sales, payouts, agreement and messages. Never your share, other vendors or customers |
| VendorDue's team | Your store and team by name and email, and totals per currency. Never individual orders, payout lines, what one vendor is owed, or your conversations. Every look at a person's details is recorded |
Support sees only what you send it.
How long things are kept#
| What | Kept |
|---|---|
| Your store's records | While you use VendorDue |
| Messages with vendors | 12 months after they're sent, then deleted |
| Support requests and security records | Generally no longer than 13 months |
| Everything, after you delete the workspace or uninstall | Erased 48 hours later, and gone from backups 7 days after that |
If something worries you#
- Someone left your team: Remove their access.
- A device you don't recognise: Sign it out.
- A vendor didn't change their payout address: the email they got has Stop this change, and nothing is paid to the new address for 48 hours.
- You think you've found a security problem: email support@vendordue.com. We reply within three working days.
Common questions#
- Does VendorDue sell or share my data?
- No. It doesn't sell personal information or share it for advertising. See the privacy policy. More
- A customer asked Shopify for their data. What do I do?
- Shopify passes the request to VendorDue, and VendorDue emails you its answer: it holds no name, email, phone or address for any customer, and lists what it holds for the orders asked about. "You can pass this on to the customer as it is." More
- Is VendorDue end-to-end encrypted?
- No. Data is encrypted on the way and when saved, but VendorDue's servers can open it to work out what's owed. The security page says what it doesn't claim. More
- Where is my data kept?
- In the United States, in a Postgres database run by Supabase, backed up daily and each backup kept 7 days. More
Thanks. We read every answer.
Checked against VendorDue on 6 Oct 2026. What's new