If your Shopify app reads customer data, such as orders or customer records, Shopify expects you to protect it in specific ways before it gives you access. The rules come in two levels. This guide explains what they cover, when Shopify reviews them, and how to get ready.
What counts as protected customer data
Shopify defines it as data that directly relates to a customer or prospective customer. In the API, that means resources such as customers, orders, fulfillments and gift cards, and the webhooks that carry them.
Within that data, four fields need a second level of access:
- Name: first and last names.
- Address: both address lines, geolocation and zip codes, in billing and shipping addresses.
- Email.
- Phone.
Access to customer data in general is Level 1. Access to any of those four fields is Level 2, and comes with more requirements.
How you request access, and when Shopify reviews it
You request access from your app in the Partner Dashboard, under API access requests, then Protected customer data access. You choose the data you need and explain why, select any Level 2 fields one by one, and complete the data protection details. Shopify asks you to choose a distribution method for your app first, even to test on development stores.
Until access is approved, the protected fields come back empty. The API returns null for them, and a GraphQL query answers with an error such as “This app is not approved to access the Customer object”. Make sure your app handles that before you submit it.
Shopify will approve your app to use protected customer data if the requested data is the minimum amount required by your app to provide the merchant with the app functionality.
The Level 1 requirements
These apply to every app with access to protected customer data. Most of them are about what your app does with the data, so they are yours to meet whatever your hosting.
The Level 2 requirements
These apply on top of Level 1 once your app reads names, addresses, emails or phone numbers. Several of them depend on how your app is hosted and run.
Good to know. Requesting fewer fields is the simplest way through review. If your app only needs an order total, it does not need the customer’s name or address.
How to get ready
- List every customer field your app reads, and the reason for each one.
- Remove what you do not need, starting with the Level 2 fields.
- Tell merchants what you process and why, in your privacy policy and in your data agreement with them.
- Set a retention period for each kind of data, and delete it on schedule.
- Check your hosting against Level 2: encryption, separate environments, backups, roles, sign-in, access logs. Ask for the answers in writing.
- Write your incident response policy before you need it.
- Handle empty protected fields in your app, so it keeps working while a request is under review.
Apps on the Shopify App Store must also handle Shopify’s mandatory compliance webhooks, which ask your app to send or delete a customer’s data, and to delete a store’s data after it uninstalls your app.
Where Meridian fits
Meridian hosts Shopify apps, so it covers part of the Level 2 list for the apps it runs. Development and Production are separate environments, each with its own database and secrets. Production databases are backed up daily. Every collaborator has a role by organization and by app, the database sits on a private network, and two-factor sign-in is available on every plan, with single sign-on on Enterprise. On Enterprise, an activity log records changes, support sessions and backup downloads.
What your app does with customer data stays with you: the Level 1 requirements, your app’s own access logging, and your incident response policy. The Trust Center sets out, requirement by requirement, what Meridian covers and what stays with your app.
Source: Shopify’s protected customer data documentation, checked on 10 October 2026. Shopify updates its requirements, so check the page before you submit your app.