It is safe to store custom information in the data field of a commerce_order or commerce_line_item entity?
Yes, you can do that.

That information is commonly used to store context or other information. For instance, you can use the $order-&gt;data to store transaction IDs or other relevant information that you might want to use later on in the lifecycle of the order. In some cases, $line_item-&gt;data might store remote keys or other information related to that line item specifically.

Just be very careful that you don't store something in there that you wouldn't want to otherwise store in your database: credit card numbers or other things that you wouldn't want if your security were ever compromised or a database backup fell into the wrong hands.