Shopify POS / New feature

POS activity log
An audit log that automatically records who did what, when, and where at the register

Automatically records high-risk register actions—cash handling, discounts, voids, refunds, and customer information access—tied to the staff member's name, time, device, and location. Scales discrepancy investigation, loss prevention, and compliance across the register floor.

What's on this page
  1. What was actually added (understand it in 30 seconds)
  2. List of recorded actions
  3. Information automatically attached to each log
  4. Where to view it (settings page)
  5. Names are resolved on every read
  6. 5 points engineers should know
  7. 3 use cases you can put to work
  8. One-line summary for pitches

1What was actually added

Shopify POS now introduces the activity log (POS activity log) .
High-risk actions at the register are nowthe staff member's name, time, device, and locationautomatically recorded along with. The goal is discrepancy investigation, loss prevention, and meeting compliance requirements.

Before: hard to track who did it

Cash handling, discounts, and voids at the register left little history, so even when a discrepancy came up, it was hard to determine after the fact when, who, and on which device it happened.

Now: high-risk actions recorded automatically

High-risk actions are logged automatically, tied to a named staff member. Time, device, and location are captured automatically too. Investigation and auditing scale.

2List of recorded actions

The article specifies these 6 types of actions as logged.

Cash drawer operations
Open / add cash / remove cash / mid-session cash count
%
Manual discounts
Manual discounts applied to the entire cart or to a line item
Voiding a transaction (void)
Voiding a transaction
Returns & refunds
Returns and refunds
Customer record access
Customer record access (viewing customer information)
Manager approval (override)
The manager override is recorded together with the approved action

3Information automatically attached to every log

When one of the above actions occurs, the following four items are automatically captured.

Staff name
named staff member
Time
time
Device
device
Location
location
In the case of a manager override, it is recordedthe approved action itselfalongside it, so you can trace both "who performed the action" and "who approved it" in a single record.

4Where to find it (settings page)

Inside the POS channel in Shopify Admin

In the POS channel in Shopify Admin, a new settings page has been added, where the events are listed.

Narrow down with three filters

Staff Location Event type You can filter by these. This lets you quickly narrow down the target when investigating discrepancies.

Regarding supported plans, supported regions, retention period, export availability, and permissions (who can view it), this article does not say. Check the Shopify Help Center and admin before rolling it out.

5Names are resolved "each time they're read"

The log itself (what is stored) Action type, time, device, location + reference IDs for the staff/customer Names are not "baked in" Resolved when viewed read time Resolves the current name The log as displayed Always shows the "current" staff name and customer name Renames and customer deletions are reflected automatically No stale PII remains
Renames and deletions of customer records are reflected automatically. Staff and customer names are Resolved at read timeso past logs always show the current value, and no stale PII lingers in the logs.

65 things engineers should know

1. Logging is scoped to high-risk operations

Six streams: cash drawer, manual discounts, voids, refunds, customer-info access, and approvals. Rather than an exhaustive log of every action, it's designed to selectively record the operations that matter for loss prevention and auditing.

2. Names are resolved by reference (resolve at read time)

The log stores a reference, and the name is resolved to its current value when viewed. Because renames and customer deletions ripple into past logs too, note that this behaves differently from designs that assume "audit log = immutable."

3. Designed to avoid leaving PII behind

By not baking in names, the PII of deleted customers doesn't remain on the log side. You could say it's built with both GDPR-style "right to erasure" compliance and audit logging in mind.

4. Investigate with three filters (staff / location / type)

The workflow is to narrow things down by applying three filters on the Admin settings page. When a discrepancy occurs, you can trace "which store, whose action, and what operation." Whether it can be retrieved via API / export is not stated.

in the article Approval

5. Approvals (overrides) are recorded together with the target operation

Manager overrides are recorded alongside the operation they approved.the "performer" and the "approver" are captured together in a single recordso the separation of duties (who performed it and who authorized it) can be clearly traced after the fact. This makes it easy to use as evidence for internal controls and fraud investigations.

73 use cases you can apply to your operations

USE CASE 1

Speed up root-cause investigation of register cash discrepancies (cash variances)

Challenge
The register cash doesn't balance at closing. Previously it was impossible to identify at what time, on which terminal, and by whom cash was taken in or out, so getting to the root cause took a long time.
Action
In the activity log, filter drawer operations (open / add / remove / mid-day counts) by location, staff, and type to narrow down the period around when the discrepancy occurred.
Impact
Reduces the effort of discrepancy investigations and helps with loss prevention. You can reach the cause based on evidence rather than relying on person-dependent interviews.
Technical notes
Because the time, terminal, and location are captured automatically, you can trace by the same standard even across stores. Retention period and whether export is possible need to be confirmed (not stated).
% Execution Approval
USE CASE 2

Internal controls for excessive manual discounts and fraudulent refunds

Challenge
Manual discounts, refunds, and voids at the storefront are used excessively, squeezing gross margin. Whose decision it was and whether approval was obtained can't be traced after the fact.
Action
Continuously monitor manual discounts, returns/refunds, voids, and manager approvals in the log. Aggregate by event type per staff member to surface outliers.
Impact
Makes compliance with the approval flow visible. Because the performer and approver are captured together in a single record, the separation of duties becomes clear and helps deter fraud.
Technical notes
Overrides are recorded alongside the operation they approved. This suits audits that cross-check against operational rules (e.g., discounts above a certain amount require approval).
USE CASE 3

Compliance / auditing for personal-information access

Problem
Audit and compliance rules require answering "who accessed customer information," but there was no mechanism to record viewing history on in-store devices.
Solution
Include customer record access in the activity log. Since names are resolved at read time, the PII of deleted customers isn't retained in the log, satisfying audit requirements.
Impact
Scales the submission of access records while remaining compatible with the right to erasure (automatically reflecting renames and customer deletions). Reduces audit costs.
Technical notes
The log is designed to resolve references rather than baking in names. View permissions and log-integrity requirements need to be confirmed against Shopify's own specifications (not documented here).

8One-line summary for pitches

"An audit log that automatically records high-risk register operations in Shopify POS (cash, discounts, voids, refunds, customer information access, and approvals),
along with the staff member's name, timestamp, device, and location."
Names are resolved at view time so stale PII isn't retained, letting you scale discrepancy investigations, loss prevention, and compliance across stores."