Fail-closed commerce
Unknown price, cost, inventory, delivery, identity, currency, discount compatibility, or attribution evidence cannot produce a binding automatic offer.
Security and trust
Commercial promises need stronger boundaries.
BuyWhen protects the path from customer request to merchant decision, private checkout, paid order, and refund evidence. Safety controls are part of the workflow, not a separate badge.
Private offer protection
Access tokens are opaque and stored as hashes. Offers are expiring, revocable, shopper-bound, product-bound, quantity-bound where relevant, and revalidated before checkout.
Data protection
Direct identifiers and protected payloads use authenticated encryption. Lookup keys use independent keyed hashing, and logs exclude tokens, contact details, and protected URLs.
Tenant and role isolation
Every merchant operation is scoped to the Shopify store and checked against explicit permissions. Team, organization, API, and SSO paths preserve tenant boundaries.
Verified external boundaries
Shopify webhooks and app proxy requests are authenticated. Outbound webhooks use HTTPS, DNS pinning, signatures, idempotency, bounded waits, and explicit retry classification.
Durable evidence
Decisions, domain events, consent, attribution, audit records, and fee corrections are append-only. Refunds create corrections rather than rewriting earned history.
Privacy lifecycle
Transactional and marketing consent are separate. Export, redaction, retention, uninstall, legal hold, channel revocation, and suppression paths are built into the data lifecycle.
Operational resilience
Web and worker health checks cover CockroachDB and Redis. Queues use retries and dead letters, migrations are drift-checked, and backup/restore plus encryption-key rotation are rehearsed.