Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (9)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Shopify ↗ | 7.7* | 5.8* |
| BigCommerce ↗ | 7.1* | 4.6* |
| WooCommerce ↗ | 8.2* | 5.7* |
| Adobe Commerce / Magento ↗ | 7.6* | 4.6* |
| Square ↗ | 7.6* | 4.9* |
| Adyen ↗ | 3.4* | 3.5* |
| ShipStation ↗ | 4.7* | 5.6* |
| Gorgias ↗ | 6.2* | 4.1* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Shopify
Ecommerce · Checked 2026-10-17
Shopify / one-merchant custom-distribution app using the GraphQL Admin API for ordinary authorized store operations. This grade excludes reusable public-app distribution and applications primarily transferring Merchant Data to third parties.
Read findings and sources ↗BigCommerce
Ecommerce · Checked 2026-10-16
BigCommerce single-store API accounts for REST catalog products and supported store webhooks; app-level OAuth distribution and account-level administration are distinct routes.
Read findings and sources ↗| Customer control | Shopify ↗ | BigCommerce ↗ | WooCommerce ↗ | Adobe Commerce / Magento ↗ | Square ↗ | Adyen ↗ | ShipStation ↗ | Gorgias ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|
| Category | Ecommerce | Ecommerce | Ecommerce | Ecommerce | Payments | Payments | Shipping and fulfillment | Support and service management | Databases and data platforms |
| Overall control | |||||||||
| Data access | |||||||||
| Third-party accessibility | |||||||||
| External action | |||||||||
| Continuity | |||||||||
| Data exit | |||||||||
| Business logic and customization | |||||||||
| Assessment scope | Shopify / one-merchant custom-distribution app using the GraphQL Admin API for ordinary authorized store operations. This grade excludes reusable public-app distribution and applications primarily transferring Merchant Data to third parties. | BigCommerce single-store API accounts for REST catalog products and supported store webhooks; app-level OAuth distribution and account-level administration are distinct routes. | Merchant-controlled WooCommerce REST API v3 order resources and core webhooks; hosting, plugins and WordPress database backup are separate operational boundaries. | Adobe Commerce PaaS and Magento Open Source merchant-authorized REST interfaces; Adobe Commerce I/O Events journaling is a separate configured route, not assumed for Magento Open Source or Commerce SaaS. | Square seller-authorized Orders and Customers APIs via OAuth; application-owned Events API with a personal token and enabled event history is a separate credential route. | Adyen merchant automated report-file download plus a separately authorized Checkout captured-payment refund operation; these are distinct credentials and do not establish a transaction-query API. | ShipStation V2 platform shipment list/create/update with customer API keys; standalone ShipStation API formerly ShipEngine and deprecated V1 have separate billing/auth/sandbox contracts. | Gorgias REST ticket collections and mutations; private account API credentials versus reviewed public OAuth applications. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-17 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Keep orders, payments and service records connected
Retail software spans storefronts, payments and fulfillment. This collection compares those roles separately (a payment transaction is not a complete POS or customer record). The reviews cover named merchant interfaces; store hardware, every loyalty program and an independently restorable retail operation are outside the evidence unless stated.
Storefronts and commerce
Compare product, customer and order extraction within the reviewed platform scope. Check variants, discounts and historical order access before treating a catalog export as a store migration.
Orders, customers and payment reports
Square covers Orders and Customers; Adyen covers automated merchant reports and a captured-payment refund operation. Verify order-to-payment and settlement relationships separately; these reviews do not establish every in-store POS function.
Fulfillment and customer service
Shipment and support records preserve different parts of the customer journey. Compare their identifiers, attachment access and recovery limits alongside the storefront rather than substituting one function for another.
What to verify before connecting or migrating
- Will exported records preserve order lines, returns and payment references across channels?
- Which store, region and account permissions constrain the extraction?
- Can historical attachments, service conversations and catalog relationships move with the records?
Industry references establish terminology and business context. The linked vendor reviews contain the assessed API, commercial and export evidence (with their own product scopes and check dates).
National Retail Federation: retail industry ↗ · ShipStation: ecommerce fulfillment ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Shopify ↗
A one-merchant custom app supports useful store access. Public connectors face a separate regime of app review, Shopify billing and revenue share; data-transfer and migration applications also face purpose restrictions.
Shopify / one-merchant custom-distribution app using the GraphQL Admin API for ordinary authorized store operations. This grade excludes reusable public-app distribution and applications primarily transferring Merchant Data to third parties.
BigCommerce ↗
BigCommerce lets merchants create scoped store API accounts for manual third-party connections. REST catalog APIs support external product reads and writes; webhook delivery has a bounded retry period.
BigCommerce single-store API accounts for REST catalog products and supported store webhooks; app-level OAuth distribution and account-level administration are distinct routes.
WooCommerce ↗
WooCommerce uses merchant-generated REST keys linked to WordPress user permissions. Its v3 API supports structured order extraction and writes, while core webhooks need reconciliation after delivery failures.
Merchant-controlled WooCommerce REST API v3 order resources and core webhooks; hosting, plugins and WordPress database backup are separate operational boundaries.
Adobe Commerce / Magento ↗
Adobe Commerce and Magento Open Source expose merchant-authorized REST interfaces with search criteria. Configured Adobe Commerce I/O Events can add seven-day event journaling, with separate entitlement and setup checks.
Adobe Commerce PaaS and Magento Open Source merchant-authorized REST interfaces; Adobe Commerce I/O Events journaling is a separate configured route, not assumed for Magento Open Source or Commerce SaaS.
Square ↗
Square exposes scoped order/customer APIs and seller-authorized OAuth connections. Its Events API can recover eligible events from the past 28 days, beyond ordinary webhook retries.
Square seller-authorized Orders and Customers APIs via OAuth; application-owned Events API with a personal token and enabled event history is a separate credential route.
Adyen ↗
Adyen offers automated merchant report downloads and a separate API for captured-payment refunds. Report access can be limited by merchant account, but reports are scoped outputs rather than a universal operational ledger or retained change log.
Adyen merchant automated report-file download plus a separately authorized Checkout captured-payment refund operation; these are distinct credentials and do not establish a transaction-query API.
ShipStation ↗
ShipStation V2 supports structured shipment records and create/update operations. Its list API caps pagination at 10,000 results, requiring narrower date/filter windows for larger collections.
ShipStation V2 platform shipment list/create/update with customer API keys; standalone ShipStation API formerly ShipEngine and deprecated V1 have separate billing/auth/sandbox contracts.
Gorgias ↗
Gorgias provides cursor-paginated ticket APIs and documented ticket mutations. Private integrations use account credentials; public apps must use OAuth and pass the partner app process.
Gorgias REST ticket collections and mutations; private account API credentials versus reviewed public OAuth applications.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.