BigCommerce Legal addendum · Legal version v1 · Last updated: July 13, 2026
BigCommerce API Compliance
Last updated: August 24, 2026
This addendum summarizes AtlasCore alignment with BigCommerce API Terms for connected BigCommerce stores.
Independent application status
AtlasCore is an independent software application. BigCommerce and related marks are trademarks of BigCommerce Pty. Ltd. AtlasCore is not sponsored, endorsed, or affiliated with BigCommerce.
Authorized API use
AtlasCore accesses BigCommerce APIs only after explicit merchant OAuth consent or a merchant-pasted store access token. Default requested scopes are read-only `store_v2_orders_read_only store_v2_products_read_only`. When `BIGCOMMERCE_WRITE_APPROVED` is true, requested scopes are `store_products store_orders store_inventory`. Catalog and order reads run when the integration is enabled. Seller writes (product create, stock/price updates, order status) run only when `BIGCOMMERCE_WRITE_APPROVED` is also true.
Data handling controls
- Token encryption: OAuth store access tokens are encrypted at rest (AES-256-GCM). There is no refresh-token grant.
Transport security: Production traffic uses TLS 1.2+.
Tenant isolation: Each AtlasCore user may link their own BigCommerce store; one active `store_hash` is allowed platform-wide. Cross-user store access is denied at the API layer.
Webhooks: Incoming BigCommerce webhooks are HMAC-verified over the raw body before JSON parse. Replay keys are namespaced by store hash.
Order data: Only operational fields (id, status, totals, currency, dates, line SKU/qty) are stored. Buyer and shipping fields are not persisted. Seller GETs return cache-only redacted rows.
Seller controls
- Disconnect BigCommerce in AtlasCore to stop sync and purge stored credentials.
Uninstall or revoke the AtlasCore app from BigCommerce as needed.
