Isolation

Shared across all stores

• Customer accounts. One sign-in works on every store.
• Customer profile, addresses, and wishlist. These follow the shopper, not the store.
• Reviews. A shopper's reviews belong to them. The product they review lives in a specific store, but the review itself travels with the shopper.

Kept separate per store

• Products and their options. A product belongs to exactly one store, and only that store's admins can create or change it.
• Orders. Each order is tied to the store it was placed at. Store admins can see orders for their own store; a shopper can see their own orders.
• Categories, coupons, shipping rates, branding, legal pages, and settings - all kept separate for each store.
• Admin notification sign-ups - tracked per store, so alerts only reach the right team.

Behind-the-scenes records

Some records are never exposed to shoppers or admins directly - they're used by NShop's own systems to run the platform:

• The outbound email queue.
• Stock briefly held during checkout.
• The queue that smooths out order status emails.
• Coupons (checked at checkout, managed by admins).
• Pending team invites.
• A history log of team changes.
• A history log of privacy and data-deletion requests.

What happens on every change

Whenever someone tries to change something, NShop:

1. Confirms who they are by checking their sign-in.
2. Looks up the role on their account.
3. Confirms that role is allowed to act on this particular store.
4. Only then makes the change.

The built-in data walls are a backstop, not the first line of defense. The platform refuses a request up front, before it ever reaches the stored data.