In principle the research project is based on having access to, and the permission of, the developer, to investigate both the front-end and the back-end of the project.
Put another way, you should have 'inside knowledge' of the product/service, its design, how it was designed, etc. in addition to having a clear view of the user/customer perspective.
For example, an investigation to improve a web service operated for a local business. We expect you to be able study and describe the existing system back-end and front-end and surrounding processes, environment, etc. in order that feature and functionality changes can be suggested, estimated, and implemented (in time).
Using this example; you would understand and describe the specific website arrangements: details like domain registration, canonical name, website hosting, additional services (e.g. email, social media), data on usage via analytics access, how and what changes might be made via the website builder (e.g. MySQL, Wordpress, php, active server, cpanel control), architecture of other systems needed like private network, virtual services etc. etc.
Ideally you should have access to backend and development team for the product/service. That is, for the development environment to be accessible
Yes, a product can be a commercial software product or service, but really only if the development and release environment is accessible to you for research. You will need to have privileged inside access, commercial operational/development environment.