Building FeedGuard: safe supplier-feed sync for Shopify

Many Shopify stores don't hold their own stock. They sell what a supplier or distributor has, and the supplier tells them what that is through a file: a CSV on an FTP server, an Excel export, a Google Sheet or a JSON endpoint. Someone downloads it, fixes the columns, imports it and hopes nothing breaks.

Moving data from A to B isn't the hard part. The hard part is what happens when the file is wrong. A truncated export can mark half a catalog as out of stock. A shifted column can write cost prices over selling prices across the whole store. A moved decimal point turns a €1,499 wheel into a €1.49 one. Most import tools do exactly what the file says, so the merchant finds out from a customer.

We wanted a safe supplier feed sync: one that treats every incoming file as untrusted until it has been checked against the live catalog. That became the brief for FeedGuard: connect to whatever the supplier sends, map it without reformatting, and refuse to write anything that looks destructive. We run into the same problem in client work whenever two systems exchange data on a schedule, which is why it sits close to our API integration projects.

The core design decision was that every run produces a diff before it writes anything. FeedGuard fetches the source, parses it, applies the mapping, reads current values from Shopify and builds a change list: matched, not found, changing, going to zero. Only then does it decide whether to apply anything. New feeds start as dry runs, and live mode is offered after three clean runs.

Four circuit breakers sit on top of the diff. They're on by default and the merchant sets the thresholds: a mass-change breaker (default 30% of the catalog), a zero-stock breaker (default 20%), a shrinking-file breaker (default 50% fewer rows than last time) and price floor and ceiling bounds. If one trips, the run stops with zero writes and the merchant gets an email with the exact reason.

Every applied change is stored with its previous value, so a whole run can be reverted in one click, and the rollback is logged as its own run. Connectors cover CSV and Excel upload, URL fetch, FTP/FTPS, SFTP, Google Sheets, S3-compatible storage and REST APIs, with delimiter and decimal-comma detection. Auto-map matches headers, including non-English ones like Lagerbestand or Preis. Chained transforms handle margins, .99 rounding, stock buffers, prefixes and lookup tables. Unrecognized status values are skipped rather than guessed. Supplier credentials are encrypted at rest with AES-256-GCM, and the app requests only product and inventory permissions. The full feature set is on the FeedGuard page.

Today FeedGuard runs supplier feeds on schedules from every 15 minutes to daily. It skips files whose checksum hasn't changed, retries failures with exponential backoff and shows live progress through each stage of a run. It can target a specific Shopify location, can create new supplier products as drafts if the merchant opts in, and keeps a per-run change log that downloads as CSV. Alerts go out by email and Slack, with an optional weekly digest.

The main thing we learned is that people trust an automation because of what it refuses to do. A sync that writes blindly is quick to build and dangerous to run. The diff, the thresholds and the undo made FeedGuard slower to design, but they make it much easier for a merchant to switch on. The worst case is now "the run stopped and told me why" instead of "the catalog is wrong".

The second lesson was about vocabulary. Suppliers describe the same thing in many different ways, so the mapping layer had to adapt to their file rather than ask them to change it. We use the same approach in the workflow automation we build for clients. If you have a feed or integration that needs the same guardrails, tell us about it.