PortfolioAbout This Topic
One of the most important design decisions in headless EC development is
"where to store customer data."
This project adopted the policy of storing all customer data in Shopify and not storing any data on our own servers.
This is not just a technical choice, but a strategic decision derived from
security, legal liability, and operational cost perspectives.
As you know, "can store" and "should store" are very different decisions.
Why This Design Decision Matters
When operating an EC site, customer data management is an unavoidable challenge.
Traditionally, the mindset that "storing data internally is standard" was mainstream, but this comes with more risks and costs than many teams expect.
Risks of Internal Storage
Benefits of Storing in Shopify
Basic Design Principles
Your server (Vercel, etc.) only temporarily processes customer data and does not store it persistently.
Authentication and session information are also managed with minimal validity periods.
Submit data via registration or my page updates
Temporary processing only. Validation and API calls. Data is not stored
Persistent storage. Customer data protected under world-class security management
For Those Who Want to Learn More
This design philosophy is explained in detail in three articles.
You can start from the angle that matches your current concern.
1. Security and Shared Responsibility
Detailed explanation of why not to store customer data internally, from security and legal liability perspectives.
-> Security and Shared Responsibility
2. Passwordless Authentication
Explanation of authentication concepts in headless architecture and passwordless authentication implementation approaches.
-> Passwordless Authentication
3. Utilizing Metafields
How to manage additional information needed for Japanese EC sites, such as furigana and birthdate, using Shopify metafields.
What This Design Enables
For Operations
- Significantly reduced security response costs and effort
- Minimized data breach risk
- Reduced burden of personal data protection law compliance
For Customers
- Personal information protected by world-class security
- Easy and secure passwordless login
- Consistent customer experience across all channels