What BYOM is (and what it is not).

Before any software gets a login to your store, give the company behind it twenty minutes. Nearly everything you need is public, free and already written down by a regulator, by Shopify or by the supplier. Here's where to look, what each source tells you and what it leaves out, so a two person team can run the checks without a lawyer.

Start with the public record

GOV.UK says you can get company information from Companies House for free: the registered address and date of incorporation, current and resigned officers, document images, mortgage charge data, previous company names and insolvency information. You can also set up free email notifications that tell you when a company updates its record, for example when a director changes or an address moves.

Three things on that record are worth reading. The incorporation date tells you how old the company really is, which is worth knowing next to a claim of years of experience. The officers tell you who is legally responsible. Previous names and charges show whether the business has changed shape or borrowed against its assets.

The filing history shows whether the company keeps up with its legal duties. GOV.UK says a company must file a confirmation statement at least once every 12 months, with a 14 day grace period after the review period ends. It costs £50 online, and a company that does not file can be fined up to £5,000 and may be struck off. A supplier whose confirmation statement is months overdue is telling you something about how it runs.

The Information Commissioner's Office keeps a second public record. Its guidance says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. Since 17 February 2025 the three tiers have been £52, £78 and £3,763, up from £40, £60 and £2,900. The ICO also tells organisations to pay renewals promptly so that their registration does not expire and drop off the public register of fee payers. A software supplier that handles your customers' names and addresses and does not appear on it has a question to answer. Appearing on it proves only that the fee was paid. It says nothing about how well the data is looked after.

A young company is not a bad sign. Plenty of good software comes from businesses incorporated last year. What you are testing is whether the record matches the pitch. A supplier that describes itself as established and shows an incorporation date from last quarter, or lists a team on its website that matches no officer on the record, has given you a reason to ask more questions before the install.

Read the privacy policy and the data processing terms

A privacy policy is written for the people whose data is collected. The agreement between you and a supplier is a different document, often called a data processing agreement or addendum, and it is the one that binds the supplier to you.

UK GDPR splits the roles in two. The controller decides why and how personal data is processed. A processor handles the data on the controller's behalf. When an app reads your customer list or your support tickets to do a job for you, you are normally the controller and the supplier is your processor. The legal duty for your customers' data stays with you, which is why the contract matters more than the marketing page.

Article 28 of the UK GDPR, as published on legislation.gov.uk, lists what the contract with a processor has to say. The processor must process personal data only on documented instructions from the controller. It must make sure the people authorised to process the data have committed themselves to confidentiality. It must take the security measures required by Article 32. It must help you respond to requests from the people the data is about, and help you meet your obligations on security and breach handling. At the end of the service it must delete or return all the personal data. And it must make available all the information necessary to show it complies.

Article 28 also covers the suppliers behind the supplier. A processor needs the controller's prior specific or general written authorisation before it engages another processor, and must tell you about changes. It must pass the same data protection obligations down by contract, and it stays fully liable to you for what that other processor does. In practice you look for three things in the paperwork: a named list of sub processors, a way to be told when the list changes, and a clear deletion or return commitment when you cancel.

Find out where your data goes

Ask where the supplier hosts data and which other companies touch it. UK GDPR does not ban sending personal data abroad. The ICO describes a restricted transfer as one that happens when UK GDPR applies to the processing, the sender initiates a transfer to an organisation outside the UK, and the recipient is a separate legal entity.

Every restricted transfer has to be covered by one of three routes. The first is UK adequacy regulations, which let data flow without extra safeguards and which the ICO calls the most efficient route. The second is appropriate safeguards, such as the International Data Transfer Agreement, the International Data Transfer Addendum or UK binding corporate rules, which come with a transfer risk assessment. The third is a narrow set of exceptions where the sender can show necessity and proportionality. The ICO adds that the organisation starting the transfer is responsible for compliance whether it acts as a controller, a processor or a sub processor.

Ask for it in writing as part of the processing terms. A good answer names the hosting region for the main database, names each company outside the UK that receives data, and says which of the three routes covers each one. The ICO guide says a sender must not make a restricted transfer when none of the three routes applies, and the appropriate safeguards route comes with a transfer risk assessment.

The useful question is which route covers each sub processor outside the UK. A supplier that can answer in one sentence has done the work. A supplier that answers that data is secure in the cloud has not answered the question you asked.

What Shopify's app review does and does not check

A listing in the Shopify App Store means the app passed a review. Shopify's requirements checklist covers performance, security, billing, privacy and quality. An app must not reduce storefront Lighthouse performance scores by more than 10 points, and Shopify measures this before and after installation, weighting home pages at 17%, product pages at 40% and collection pages at 43%. A slow app costs you conversions in every session, so that limit protects your store as much as Shopify's. Apps must use OAuth to authenticate, must have a privacy policy, and must use supported APIs. They should charge through Shopify's own billing, so a merchant can change plan without contacting support.

Public apps must also respond to three mandatory compliance webhooks: customers/data_request, customers/redact and shop/redact. Shopify's documentation says to complete the action within 30 days. It also says that 48 hours after a store owner uninstalls an app, Shopify sends the shop/redact payload, which is the signal to delete that shop's data. If you uninstall an app and the supplier never deletes your data, that webhook is where the process is meant to start.

The Shopify Partner Program Agreement, last updated 27 February 2026, adds duties that bind the developer. Partners with access to merchant data may only use or store it to provide their services to that merchant, must keep it only as long as reasonably necessary, and must report breaches no later than 24 hours after becoming aware of one. Developers cannot use merchant or customer data to train or improve machine learning or artificial intelligence systems without explicit written consent from Shopify or the merchant. That last rule is worth checking against any AI product you install.

The checklist describes the app and its behaviour on Shopify. It does not list the company's accounts, its hosting region or its sub processors. Those stay your job.

A short routine makes the checks repeatable. Search the company name on Companies House and note the incorporation date, the officers and the date of the last filings. Search the ICO register for the same name. Open the privacy policy and the processing terms and find the sub processor list and the deletion clause. Then install the app on a development store, uninstall it, and ask the supplier in writing what happens to the data from that point. You will have a file of five or six dated notes, which is also what you would hand to an insurer or an auditor if one ever asked how you chose the supplier.

The suppliers worth keeping tend to reply with specifics, such as a hosting region, a list of named companies, a retention period in days. If a supplier cannot answer, count that against them.

Questions to put to any vendor

The National Cyber Security Centre's supply chain guidance, built around 12 principles, says that very few UK businesses set minimum security standards for their suppliers. It points to the Cyber Essentials scheme as a tangible, efficient way to gain assurance that a supplier has put the basic technical controls in place. A scheme badge on a website is not proof, so ask for the certificate details and check the date. The table below turns these sources into questions you can send in one email.

Send those questions before you connect a store, and keep the replies with your records. If a supplier takes a week to say where it hosts data, you have learned how it will answer when something goes wrong.

AI features add one more name to check. When a product sends your store data to a model run by another company, that company is another processor in the chain. Ask which model providers receive your data, in which region, and whether the data may be used to train or improve their systems. Shopify's Partner Program Agreement already restricts developers on that last point unless the merchant consents in writing, so the answer should be no, and the supplier should be able to say so without checking.

What bring your own model means in the industry

The letters BYOM appear in more than one place in software. Alation's article on the topic, published on 31 August 2026, defines bring your own model as a capability that lets an enterprise connect its own provider accounts, endpoints or self hosted models to a vendor platform, so that inference runs under the enterprise's chosen provider, region, credentials and policies rather than the vendor's defaults.

In that sense it describes a platform setting. When you read a supplier's page, check whether the phrase describes a setting you can change or the name of the business you are dealing with. The Companies House record answers that in one search.

Where BYOM fits

BYOM Ltd is a UK software company, registered in England and Wales.

BYOM is not Bring Your Own Meeting, and it is not a synonym for Bring Your Own Model. The company is BYOM Ltd.