M
MakerSyncDocs
Back to Core Concepts

Platform Data Isolation & Security

Technical overview of MakerSync's inbound-only hub architecture, strict data segregation policies, and technical safeguards guaranteeing zero data transfer between connected third-party platforms.

1. Inbound-Only Hub Architecture

MakerSync is built as a back-office manufacturing and workshop ERP. It is not a marketplace syndication tool, cross-listing bridge, or data brokerage service.

When an artisan connects storefronts (such as Etsy and Shopify), MakerSync acts as a centralized workshop hub. All data flows are strictly inward-only into the merchant's private database to track workshop ingredient depletion and calculate recipe costs.

MakerSync Channel Isolation Model
Etsy Open API v3
Read-Only Order Events
Inbound Flow Only ↓
MakerSync Local ERP Hub
Bill of Materials (BOM)
Studio Raw Materials Pool
Private Tenant Database
Shopify Admin API
Independent Store Stream
Inbound Flow Only ↓
STRICT ISOLATION BARRIER: ZERO DATA EXCHANGED BETWEEN ETSY & SHOPIFY

2. Zero Cross-Platform Data Transfer Guarantee

Policy Statement on Data Egress

MakerSync enforces a strict prohibition on cross-platform data transfer. Data read from the Etsy Open API is utilized exclusively inside MakerSync to calculate physical workshop supply subtractions. MakerSync never transfers, exports, bridges, syncs, or shares Etsy listings, orders, sales analytics, or buyer information with Shopify or any other third-party platform.

  • No Outbound Sync Engine: MakerSync contains no code paths, background jobs, or queue workers designed to push Etsy inventory counts, listing titles, or pricing into Shopify.
  • Independent Integration Pipelines: The Etsy integration service and Shopify integration service operate in completely isolated modules with separate OAuth credentials, distinct database tables, and independent webhook processors.
  • No Data Reselling or Aggregation: MakerSync does not aggregate marketplace data across multiple sellers or sell marketplace intelligence to data brokers.

3. Technical Safeguards & Least Privilege

To ensure adherence to the Etsy API Terms of Use, our engineering architecture applies the following technical constraints:

Read-Only OAuth Scopes

MakerSync requests only the minimal read scopes necessary for order deduction (listings_r, transactions_r, shops_r). Write permissions (listings_w) are never requested.

Row-Level Security (RLS)

All customer workspaces are strictly segregated at the database tier using Postgres Row-Level Security. Data from one organization can never be queried or accessed by another.

Cryptographic Key Isolation

Access tokens and refresh tokens are encrypted at rest using AES-256-GCM with PBKDF2 key derivation. Secrets are decrypted only in runtime memory during authorized webhook verification.

Automatic Stale Cache Eviction

In compliance with Etsy's 6-hour listing freshness rule, background sync routines automatically refresh listing caches every 4 hours, and canceled accounts are purged following a 60-day retention cutoff.

4. Seller & Member Privacy

MakerSync acts as a service provider to craft businesses. In compliance with Section 5 of the Etsy API Terms of Use:

  • We never store or solicit Etsy member account passwords.
  • We never send emails, text messages, or direct marketing communications to Etsy buyers.
  • We do not intercept, redirect, or circumvent Etsy checkout or payment systems.
  • Sellers may disconnect their Etsy integration at any time with a single click in Settings, immediately triggering access token revocation.

Legal Disclaimer: The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.

For further inquiries regarding data privacy or security architecture, contact our compliance team at support@makersync.app.