Resources Categories

Back

INDUSTRY FACT FILE · RETAIL & E-COMMERCE

Main Products and Services in Retail and E-commerce

What India's retailers, marketplaces, D2C brands and quick-commerce platforms sell and deliver, the storefront, payment, fulfilment and data systems behind each activity, and where those systems create cybersecurity and compliance exposure.

In this document

1. How retailers and platforms earn their money

2. Products and services by retailer type

3. The storefront layer: web, apps, APIs and checkout

4. The operations and data layer: OMS, WMS, POS, loyalty and CRM

5. The systems behind the products and services

6. Trends that change the attack surface

7. Mapping operations to Codec Networks engagements

1. How retailers and platforms earn their money

Revenue stream	How it works	Security relevance
Merchandise sales	Goods sold in stores, on apps and through marketplaces at a margin	Checkout availability; pricing and promotion integrity; payment data
Marketplace commissions and fees	Commission, listing, fulfilment and advertising fees from sellers	Seller portals and APIs; catalogue integrity; seller data
Quick-commerce delivery and platform fees	Delivery, handling and small-basket fees on rapid orders	Dark-store WMS, rider apps and dispatch availability
Advertising and retail media	Sponsored listings, banners and data-driven advertising	Customer data use, consent and ad-platform integrations
Loyalty, subscriptions and financial services	Memberships, points, co-branded cards, BNPL and insurance attach	Stored value, account security, partner integrations
Private labels and D2C margins	Own brands sold at higher margins through owned channels	Storefront platform security; supplier and brand data

2. Products and services by retailer type

Retailer type	Main products and services	Key systems
Retail chains and supermarkets	Grocery, general merchandise, apparel and home products in stores and online	POS, ERP, store networks, loyalty, supply chain and e-commerce platforms
Online marketplaces	Multi-category catalogues from third-party sellers, fulfilment and ads	Web and app storefronts, search, pricing and cart APIs, seller portals, OMS
D2C brands	Own-brand products through owned storefronts and marketplaces	Hosted commerce platforms, plugins, CRM, marketing automation, 3PL integrations
Quick commerce	Groceries and essentials delivered in minutes from dark stores	Consumer app, dark-store WMS, rider app, dispatch and routing, partner APIs
Omnichannel and fashion retailers	Apparel, footwear and lifestyle across stores and digital channels	Unified commerce, OMS, click-and-collect, returns, loyalty, franchise systems
Payments, loyalty and gift cards	Wallets, points, stored value, co-branded cards and offers	Payment integrations, token vaults, loyalty engines, gift card platforms

3. The storefront layer: web, apps, APIs and checkout

A retailer's storefront is a web application, one or more mobile apps and a set of APIs that search catalogues, price items, manage carts, apply coupons and complete orders. Behind them sit a content delivery network, a web application firewall, identity and OTP services, and the payment page—usually a hosted or embedded checkout from an RBI-authorised payment aggregator that routes UPI, cards, net banking, wallets and BNPL. Since October 2022 saved cards are tokens, not card numbers, and the retailer's own systems should never see a primary account number.

This layer changes constantly. Engineering teams release daily, marketing adds tags, chat widgets and analytics scripts, and third-party plugins extend hosted platforms. Every script on the payment page can read what the shopper types, which is why PCI DSS v4.0.1 now expects an inventory of payment page scripts and tamper detection. Public APIs built for the app are also reachable by bots that scrape prices, hoard inventory, test stolen cards and replay leaked credentials; without rate limits and bot management, the festive sale is as open to scalpers as it is to shoppers.

4. The operations and data layer: OMS, WMS, POS, loyalty and CRM

Behind the storefront, the order management system allocates orders to stores, warehouses or dark stores; the warehouse management system and rider apps pick, pack and deliver; point-of-sale terminals and store networks sell in person; and ERP, finance and HR run the business. Loyalty engines, gift card platforms and wallets hold stored value that is effectively cash. CRM, customer data platforms and analytics warehouses hold names, phone numbers, addresses, purchase histories and sometimes identity documents—exactly the data that the DPDP Act will govern and that appeared for sale after the BigBasket, Domino's India and boAt incidents.

Much of this estate is operated by partners. Commerce SaaS, POS vendors, payment aggregators, couriers, 3PLs, dark-store franchisees and marketing agencies all hold credentials, API keys or VPN access. The Target breach of 2013 began with an HVAC vendor's credentials and the Marks & Spencer attack of 2025 reportedly began through a contractor; in retail, third-party access is the most common unmonitored path to the platform.

Highest-risk moments

Festive and flash sales when traffic, bots and change windows peak; new scripts, plugins or payment methods added to the checkout; app releases that expose new APIs; cloud exports of customer data for analytics; onboarding of franchisees, couriers and agencies with access; and loyalty or gift card promotions that create stored value are where retail incidents typically begin or escalate.

5. The systems behind the products and services

Title: Figure 2: Where cyber risk sits across the retail and e-commerce journey. - Description: Figure 2: Where cyber risk sits across the retail and e-commerce journey.

Figure 2: Where cyber risk sits across the retail and e-commerce journey.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Discover and browse	Web and app storefronts, CDN, search, ads, social commerce	Scraping and bot management, fake-app and domain monitoring, WAF tuning
Account and cart	Identity, OTP and session services, cart, pricing and coupon APIs	ATO and credential-stuffing tests, business-logic testing, rate limits
Checkout and payment	Payment aggregator integration, hosted fields, tokens, UPI, BNPL, 3-D Secure	Payment page script controls, integration review, PCI DSS scoping, RBI rules
Fulfilment	OMS, WMS, dark-store systems, POS, courier and 3PL APIs	Segmentation, partner access controls, backups, store and POS assessments
Loyalty and returns	Loyalty engine, gift cards, refund and returns workflows, promotions	Redemption and refund controls, velocity checks, fraud signal monitoring
Data and marketing	CRM, CDP, analytics warehouse, cloud storage, ad platforms	Cloud posture, secrets management, DPDP consent and retention, DLP

6. Trends that change the attack surface

Trend	What is changing	Security implication
Quick commerce and dark stores	Hundreds of micro-warehouses, rider fleets and franchise partners	Many more sites, devices and partner identities to secure
Mobile-first and API-first platforms	Apps and public APIs replace the website as the primary channel	API security, mobile app hardening and bot management become core
Tokenisation and new payment methods	Card-on-file tokens, UPI variants, BNPL and credit on UPI	Integration security and payment page controls replace card storage controls
ONDC and open commerce	Buyer and seller apps interoperating over an open network	New API trust boundaries and participant assurance
AI personalisation and agentic shopping	Recommendation engines, chatbots and AI agents that buy on behalf of users	Prompt injection, data leakage and automated abuse join the threat list
Regulatory formalisation	CERT-In audits, PA Directions 2025, dark-pattern rules, DPDP	Evidence-based assurance and privacy engineering replace informal practice

7. Mapping operations to Codec Networks engagements

If the company operates…	Recommended starting engagement
A website, mobile app or public APIs	Web, mobile and API VAPT with business-logic testing and pre-season retests
A checkout with gateway, UPI, BNPL or saved cards	Payment integration review, payment page script controls, PCI DSS v4.0.1 and RBI readiness
Loyalty, gift cards, wallets or refunds at scale	Account takeover testing, redemption and refund control review, fraud signal monitoring
Stores, dark stores, WMS or franchisees	Store, POS and WMS assessments; zero-trust partner access; backups and segmentation
CRM, CDP or cloud analytics with customer data	Cloud posture review, DPDP programme, data minimisation and DLP
Festive or flash sales	Load, API and DDoS resilience testing, bot management design, war-room exercises and SOC watch

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by retailer and platform.