Hi all,
We’re a SOX-compliant organization using Shopify Plus, and we’re working to build an audit-ready change management process. As part of this, our auditors require a detailed system-of-record report that captures changes made in our Shopify production environment.
Specifically, we need to track changes in the following areas:
Product creation or updates
SKU additions or edits
Price changes (including changes made as part of A/B tests)
Will not list product specific updates and won’t cover the scope of detail you listed. Some apps, like Matrixify, will provide CSV/Excel export of this data.
For a more in-depth audit log, you’re looking at consolidating data from Shopify’s API. If you’re working with a developer, have them review Shopify’s dev documentation on Webhooks, Event API, and specific objects if needed. Alternatively, you can contact a Shopify Expert, like me, or find one in the Shopify Partner Directory to prepare a solution.
I have no experience or affiliation with it, but there is also an app called Logify.
One distinction that may be useful for a SOX-style process is between an activity log and evidence of the change-control lifecycle.
A consolidated webhook/API log can help establish what changed and when, but for audit purposes I would also try to preserve the requested change, the approval/authorization attached to that exact change, the execution result, and the resulting production state.
In other words:
requested state → approval → execution → verified live state
That makes it much easier to distinguish an authorized production change from a later external overwrite or an unintended update, instead of reconstructing the control only after the fact.
@CommerceGov’s split is the right frame, and the native logs sit on the wrong side of it.
The store activity log won’t survive an audit. It caps at 250 entries, there’s no date range, and Shopify’s help says it can’t be exported, only screenshotted.
Admin API events are the better base, with two limits to know first. Event data is kept for one year, so anything you don’t archive is gone. And an event gives you a readable message plus a flag for app or user, not the old and new values, so the field diff has to come from your own snapshot. Subscription contract changes have their own webhook topics, and the same gap applies.
You’re on Plus, so one source does name the actor. The audit_events/admin_api_activity webhook allows one active subscription per Plus store and delivers only to Google Cloud Pub/Sub or AWS EventBridge, and the payload carries the actor app name and an on_behalf_of user email. Shopify describes what it covers in a 2023 changelog post rather than in the reference docs, so I’d confirm the current scope with support before building the control on it.
I haven’t run that webhook in production, so that last part is documentation rather than experience.
Thanks @v.marychenka, this is very useful — especially the distinction around actor attribution.
Even if the audit event tells us which app or user performed the write, there still seems to be a separate question: was that exact change actually authorized, and did production end up matching what was approved?
Have you seen teams preserve an approval-linked diff or snapshot before execution, or is that usually reconstructed afterward from separate systems?