ACCESS MODEL, DATA STORAGE AND INTEGRATION

When a sales rep signs in on behalf of a customer, they are registered as a contact with ordering permission at the corresponding company location. The order then runs through the regular B2B checkout, using the same catalogs, price lists, ordering rules, and payment methods as a self-service order placed by the customer.

That removes the constructions common to comparable approaches: no simulated customer session, no shared credentials, no technical collective account.

Sales reps need neither staff seats nor permissions in the Shopify admin. This explicitly includes external sales partners and independent sales agents.

Permissions are granted through individual customers, through companies, or through tags.

After logout, the sales rep is removed from the customer's company. The same applies to the previous membership when switching to another customer. Company memberships therefore do not accumulate across sessions.

A home company can optionally be set, which the rep falls back to after every logout. This matters for stores that hide assortment and prices entirely behind the login: without a home company, the rep would have no access to the store between two sessions.

Assignments can be revoked centrally at any time; access ends immediately.

The first time a sales rep accesses a customer, that customer's consent is obtained and documented. Recorded are the Shopify customer ID and full name of the sales rep, the date of consent, and a context note the rep enters themselves — for example that consent was given by phone with a named person.

The record is kept for subsequent orders.

Only the last four digits of the company payment method on file are visible. Full card data is never displayed, transmitted, or stored. Payment runs through Shopify's standard checkout.

Every order is attributed to the sales rep who placed it and can be reported on afterwards.

All configuration — the sales rep flag, assignments, home company, and consent records — lives in metafields on the store. No customer, rep, or order data is stored or transmitted outside the store.

The app stores the technical installation data of the store, including the access token. No personal data is involved.

The fields are app-owned and addressed through the app's namespace, for example customer.metafields.app-<id>.sales_agent_note. They are readable and writable for your own systems through the Admin API; staff with the corresponding permissions have write access as well.

Another app with a matching scope and knowledge of the app ID can read and write these fields too. That is the standard behavior of Shopify metafields, but it should be known when evaluating the access model. Restricting it is a matter of the API scopes granted to the other installed apps.

Workflows that react to orders/create and read the customer should be configured with a delay of one minute. Otherwise they see the sales rep instead of the customer. The delay is set per workflow and should be kept in mind for workflows created later.

The same applies to connectors reacting to orders/create. Most integrations run on an interval of several minutes anyway.

Applications that react immediately to an incoming order — review, loyalty, notification, or shipping apps, for example — can show the same effect. Reviewing the installed apps before rollout is advisable.

Shopify's standard confirmation goes to the sales rep. The app optionally sends a multilingual confirmation with explanatory text to the customer — or none at all, if the ERP produces an order confirmation anyway.