WooCommerce Legal addendum · Legal version v1 · Last updated: July 13, 2026
WooCommerce API Compliance
Last updated: August 22, 2026
This addendum summarizes AtlasCore controls for WooCommerce store connections via the WooCommerce REST API.
Independent application status
AtlasCore is an independent software application. WooCommerce and related marks are trademarks of Automattic Inc. AtlasCore is not sponsored, endorsed, or affiliated with WooCommerce or Automattic.
Authorized API use
AtlasCore accesses a WooCommerce store only after the merchant provides authorized REST API consumer key and secret. There is no OAuth connect path. Access is limited to catalog and order reads unless AtlasCore write approval (`WOOCOMMERCE_WRITE_APPROVED`) is enabled; then product create, stock/price updates, and order completion may run using the merchant’s key permissions.
Data handling controls
- Credential encryption: Store API keys and secrets are encrypted at rest (AES-256-GCM).
Transport security: Production traffic uses TLS 1.2+.
Tenant isolation: Each AtlasCore user links their own store within an optional workspace (`X-Tenant`). Cross-user store access is denied. One active store URL is allowed platform-wide.
Webhooks: Incoming WooCommerce webhooks for linked stores are HMAC-verified over the raw body when a per-store webhook secret is configured. `webhook.ping` is an unsigned `200` handshake and is not persisted. A non-Woo timestamp header is not required.
Order data: Only operational fields (id, status, totals, currency, dates, line SKU/qty) are stored. Buyer and shipping fields are not persisted. Seller GETs return cache-only redacted rows.
Seller controls
- Disconnect WooCommerce in AtlasCore to stop sync and purge stored credentials and cached order/product PII.
Rotate or revoke REST API keys in the WordPress / WooCommerce admin as needed.
