Read-only by design
A WooCommerce key with write permission and a full Stripe secret key are refused when you connect them.
Security and data protection
Why Business Watchdog is safe for your store
You are about to give a monitoring service access to your shop and your payment accounts. This page shows exactly what Business Watchdog reads, what it never does and how it protects your data — with screenshots of the real product and the exact permission lists.
Business Watchdog at a glanceApplies to every connection
What it does
- Reads orders, payment states and refunds
- Compares them with Stripe and PayPal
- Walks through your checkout like a shopper — up to the payment form
- Alerts you by e-mail or Telegram
What it never does
- Change, cancel or create orders
- Refund, capture or move money
- Ask for your customers’ names, addresses or e-mails
- Ask for your admin password
Six promises behind every connection
They are built into the service, not just written down: where a platform allows it, the service refuses access that is wider than it needs.
No customer data needed
No names, addresses, e-mails, phone numbers or order items of your customers are requested.
Keys, not passwords
You never share an admin password. Keys are stored encrypted; after saving, only their last characters are visible.
Stored in Germany
Servers and encrypted backups are in Germany. We process your store data as a processor under Art. 28 GDPR.
Never buys anything
The checkout check stops at the payment form. It never places an order and never enters card details.
You stay in control
Revoke a key, stop the plugin with one click or delete your organisation — at any time.
WooCommerce: a key that can only read
You create the key yourself in WooCommerce and choose the permission. Business Watchdog checks it when you connect.
- Only a key with the permission Read is accepted. The service checks the key without writing anything and refuses a key that could write.
- Only reading requests (GET) to a fixed list of addresses. Any other request is blocked before it leaves the service.
- Only the order fields listed here are requested. Billing and shipping addresses, the customer and the order items are not.
- The order key is stored only as a one-way hash.
The only requests sent to your store
GET /wp-json/wc/v3
GET /wp-json/wc/v3/orders
GET /wp-json/wc/v3/orders/{id}/refunds
GET /wp-json/wc/v3/webhooksOrder fields requested (_fields)
id, number, status, currency, total,
payment_method, payment_method_title,
transaction_id, order_key, created_via,
date_created_gmt, date_modified_gmt,
date_paid_gmt, refunds, meta_dataWooCommerce cannot return single meta keys, so from meta_data the service keeps only payment references (payment mode, the provider’s refund ID) and discards everything else immediately.
Stripe: only a restricted key with read rights
Stripe lets you create a restricted key that can do nothing but read. That is the only kind of key Business Watchdog accepts.
rk_…), shown only by its last characters.- A full secret key (
sk_…) is refused with the message: «Only a restricted read-only key (rk_…) is accepted». - Only reading requests: payments, charges, refunds and — if you allow it — disputes and fees.
- Permissions you do not grant simply stay unavailable; the dashboard tells you what is not visible instead of guessing.
Permissions of the restricted key
Payment Intents Read
Charges Read
Refunds Read
Disputes Read optional
Balance Read optional, for fees
Account Read optional
Webhook Endpoints Read optional
Everything else NonePayPal: where read-only does not exist, we say so
PayPal cannot issue read-only credentials
By PayPal’s rules, even an app with only Transaction Search may also refund payments. Business Watchdog never does that: it calls only reading methods from a fixed list and blocks every other request before it is sent. The dashboard shows this warning before you connect, and you confirm it.
The only PayPal methods the service calls
POST /v1/oauth2/token sign in
GET /v1/reporting/transactions
GET /v2/checkout/orders/{id}
GET /v2/payments/captures/{id}
GET /v2/payments/refunds/{id}
GET /v2/payments/authorizations/{id}
GET /v1/customer/disputes optional
GET /v1/customer/disputes/{id} optional
GET /v1/notifications/webhooks
POST /v1/notifications/verify-webhook-signatureThe two POST requests only sign in and check that a webhook really came from PayPal. Credentials are stored encrypted, and you can delete the app in PayPal at any time.
Shopware: permissions you see before you install
Before installing the Business Watchdog App, Shopware shows you its permissions — they are all read permissions. With an integration key, you create a role that may only view orders.
Permissions of the App (manifest.xml)
<permissions>
<read>order</read>
<read>order_transaction</read>
<read>order_transaction_capture</read>
<read>order_transaction_capture_refund</read>
<read>currency</read>
<read>payment_method</read>
<read>state_machine</read>
<read>state_machine_state</read>
</permissions>- The fields of each order are limited explicitly: number, amount, currency, states, payment method and times — no customers, addresses or line items.
- Shopware searches with POST requests; the service may send only these — reads, plus the App’s own two records.
POST /api/oauth/token
POST /api/search/order
POST /api/search-ids/order
POST /api/search/custom-entity-bw-checkout-report
POST /api/_action/sync only the App’s own recordsHonestly: Shopware lets even a «view only» role change order, payment and delivery states. The service never sends such requests — they are not on the list above.
The WooCommerce plugin: optional and easy to stop
The plugin is not required — a read-only key is enough. It adds instant updates and payment attempt counts. It is published in the WordPress.org plugin directory, reviewed by the WordPress.org plugin team.
It sends
- The same order and refund facts as the key, but instantly
- Counts of payment attempts per payment method
- Only if you switch it on: counts of checkout steps
It never
- Sends names, addresses, e-mails, phone numbers, order items, IP addresses or visitor IDs
- Takes part in payment, order creation, stock or store e-mails
- Slows your store down: if the service is unreachable, your shop keeps working
The checkout check never buys anything
A browser walks through your store like a shopper — product, cart, checkout — and stops at the payment form.
- Every request that would place an order, pay, capture or refund is blocked.
- If you allow the full payment form check, the scripts of Stripe, PayPal and other providers are loaded read-only; any writing request to them is blocked too.
- Input fields and addresses are masked in the check’s screenshots.
- The optional observation script sets no cookies, stores nothing on your customers’ devices, reads no form fields and reports only to your own store.
How your data is stored
Short retention, encryption and access only with your approval.
GermanyServers and encrypted daily backups
90–365 daysOrder history, depending on the plan
30 daysScreenshots of checks
72 hoursMaximum support access, only with your approval
- Hosting: Contabo GmbH, Munich, as our processor.
- Connection keys are encrypted; after saving, only their last characters are visible.
- Your team signs in with two-factor authentication or passkeys if you want; actions in your account are kept in an audit log.
- Support sees a store’s details only after the organisation owner grants access — for one store, chosen areas and at most 72 hours. Every access is logged.
You stay in control
- Revoke an API key in your store, Stripe or PayPal at any time — reading stops at once.
- Stop the WooCommerce plugin with one click or deactivate it.
- Delete your organisation: account data is deleted within 30 days unless the law requires us to keep it.
GDPR questions
Is Business Watchdog a processor under the GDPR?
Yes. We process your stores’ data on your behalf as a processor under Art. 28 GDPR. The data processing terms are part of our Terms of Service (Section 15).
Where is the data stored?
On servers in Germany, with daily encrypted backups that are also kept in Germany. Details, including where the service is operated from, are in the Privacy Policy.
Which other services receive data?
Contabo GmbH runs the servers and backups. Paddle handles subscription payments as an independent controller. Telegram receives alert texts only if you connect a Telegram chat.
Do my customers have to consent to checkout observation?
The observation script sets no cookies, stores nothing on the device and collects no personal data of your customers. In the dashboard you find a ready paragraph for your privacy policy and a legitimate interest assessment template. Please review them with your own legal adviser.
How long is data kept?
Order history for 90, 180 or 365 days depending on the plan, check screenshots for 30 days, account data until 30 days after the account is closed.
Can I have my data deleted?
Yes. Deleting your organisation removes its account data within 30 days, unless a legal retention duty applies. Revoking keys stops new data at once.
See it for yourself — without giving any access.
Check the public path to your checkout for free, without signing up, or watch the one-minute videos recorded on a test shop.