· Giraffe
Shopify store security for Singapore merchants
Your Shopify admin holds customer names, addresses and order history, and controls where your payouts go. This guide covers the settings and habits that keep a Singapore store secure.
Give everyone their own login
Shopify's security best practices say never to share your login, even with staff or family. Add people as users in Settings > Users instead, so each has their own credentials. Shopify's user management page notes that adding users with store roles depends on your plan, so check what yours allows.
- Give each person only the permissions they need. A packer doesn't need payment settings.
- Suspend accounts as soon as someone leaves, and revoke device access for lost phones.
- Give freelancers and agencies their own accounts, and remove them when the job ends.
Turn on two-step authentication
Two-step authentication means a stolen password isn't enough to log in. Shopify's sign-in security page says:
- you can use an authenticator app, security key or passkey (new SMS setups aren't offered);
- Shopify Payments requires it, and without it payouts might be put on hold.
You can require it for each staff member in Settings > Users; Shopify Plus can require it for everyone. The CSA also recommends two-factor authentication wherever it's available, so turn it on for your email, domain registrar and social accounts too.
Watch for phishing
The CSA describes phishing as messages disguised as coming from a legitimate sender, by email, SMS or social media. Before clicking, check the sender and the link's domain. Shopify says its support team doesn't ask for your Shopify password. Be especially wary of messages that urge you to "verify" your store, change payout details or install an app.
Apps and access
- Review the permissions an app asks for before installing.
- Uninstall apps you no longer use.
- Check collaborator and app access every few months.
See Shopify apps a new Singapore store actually needs.
Your PDPA duty to protect data
Section 24 of the PDPA requires reasonable security arrangements to protect personal data in your possession or control. The PDPC calls this the protection obligation. Staff logins, two-step authentication and limited permissions are part of meeting it. Don't export customer lists to personal drives or chat groups. See our PDPA guide, and for card fraud see our fraud and chargebacks guide.
Tell staff the rules
Write down who can access what, how customer data is handled and what to do if something looks wrong, and include it alongside your store policies.
Frequently asked questions
Should I share my Shopify login with staff?
No. Shopify advises never sharing your login credentials and adding staff as users with their own logins instead. That way you can limit what each person can access and remove them when they leave.
Is two-step authentication required?
It's strongly recommended for everyone, and Shopify requires it to use Shopify Payments. Without it, payouts might be put on hold. You can also require it for individual staff in Settings > Users.
How do I spot phishing aimed at my store?
Check the sender and the link's domain before clicking, and be wary of urgent messages asking you to log in or pay. Shopify says its support team doesn't ask for your Shopify password.
Does the PDPA require me to secure customer data?
Yes. The PDPA's protection obligation requires reasonable security arrangements for personal data in your possession or control, which includes order and customer data in your Shopify admin and apps.
Setting up a new store? Start a Shopify trial, add staff accounts with their own logins, and turn on two-step authentication from day one.
References
Rules, features and fees change, so check the live page before you act on anything here.
- Account security best practices, Shopify Help Center. Accessed 22 October 2026.
- Securing your account with two-step authentication, Shopify Help Center. Accessed 22 October 2026.
- Two-step authentication for users, Shopify Help Center. Accessed 22 October 2026.
- Managing users from your Shopify admin, Shopify Help Center. Accessed 22 October 2026.
- Permissions, Shopify Help Center. Accessed 22 October 2026.
- Protecting individuals and businesses from data breaches, Cyber Security Agency of Singapore. Accessed 22 October 2026.
- Personal Data Protection Act 2012, section 24, Singapore Statutes Online. Accessed 22 October 2026.
- Data protection obligations, Personal Data Protection Commission. Accessed 22 October 2026.