What permissions does a Shopify inventory app need?
A Shopify inventory app needs read access to three things: your products and their variants, your current inventory levels, and your order history. Restoc is built to ask for exactly that, because a reorder point is arithmetic on those three inputs and nothing else.
Why the list is short, and why it is read only
Products tell an inventory app which SKUs exist. Inventory levels tell it how many are on the shelf right now. Orders tell it how fast each one sells. Those three feeds are the whole input to a reorder point, so a reorder app has no reason to ask for more.
Restoc is built around read access to those three feeds. The Shopify Admin API access token it stores is used to read products, inventory levels and orders, and to verify the webhook deliveries Shopify signs with the app's secret key. Read only on those three feeds, full stop. Both the token and the secret key are held server-side and never shown in the app.
One field inside the products feed is worth naming, because it saves real typing. Each Shopify product carries a vendor, and Restoc reads it on the scheduled sync so you can set a lead time once per supplier and have it fill every SKU under that vendor that has no lead time of its own. It is the same read, used twice.
Before you accept any install, read the access list in front of you against the job the app does. A reorder number needs three feeds. Anything past them is worth a question before you press accept.
The connection itself runs through Shopify OAuth, with webhooks plus a scheduled sync job keeping the numbers current. The page on how Restoc connects to your store walks through that install, so this one stays on the data.
The three feeds, and what each one answers
Products and their variants
Which SKUs exist, their titles, your own SKU code, the Shopify variant id and the product's vendor. Without the catalogue there is nothing to track, nothing to name in an alert and no supplier to hang a lead time on.
Inventory levels
How many units are on hand right now. This is the number compared against the reorder point, and the number that decides whether an alert fires.
Order history
Quantities and dates sold per SKU, with the Shopify order reference. Sales velocity comes from this over a window you pick, 7, 14 or 30 days. Velocity against your lead time, plus a store-wide safety stock percentage if you set one, gives the reorder point.
What Restoc stores once it is connected
| Stored | Why |
|---|---|
| Your store's .myshopify.com domain, a Shopify Admin API access token and that app's API secret key | To read products, inventory levels and orders, and to verify the webhook deliveries Shopify signs with the secret key. Both are stored server-side and never shown in the app. |
| Tracked SKUs: title, your own SKU code, Shopify variant id, current stock, lead time, the vendor read from the product, and the computed reorder point | To work out days of inventory remaining, safety stock in units, and when each SKU crosses its reorder point. |
| A lead time per vendor, where you have set one | So one number fills every SKU under that supplier that has no lead time of its own, instead of hundreds of rows saved one at a time. |
| Sales quantities and dates per SKU, with the Shopify order reference | To calculate sales velocity over your chosen window. No customer names, addresses or payment details are stored. |
| Sync bookkeeping: when your store last synced, whether its stock came from Shopify or sample data, how much of your catalogue it read, and any sync error | So a stalled or partial sync can be seen and fixed rather than quietly showing you stale stock. |
| Which setup steps your account has reached, account created, store connected, first sync, first lead time saved, and when it reached each | So a setup that stalls can be found and fixed instead of looking like a store that lost interest. |
| Your alert settings: the email address alerts go to, and a Slack webhook URL if you set one | To deliver reorder alerts where you asked. |
| Your name, email address and a hash of your password | To sign you in. Sign-in is email and password. |
| Your plan tier, trial end date and the state of your Shopify subscription charge | To know what your plan allows and whether the trial is still running. Payment details stay with Shopify and never reach us. |
What Restoc does not see
Four things are worth saying plainly, because each one is declared rather than implied.
- Customer records. A reorder point counts units, not buyers. From an order, Restoc stores the quantity, the date and the Shopify order reference against the SKU. No customer names, no addresses, no payment details.
- Card details. Billing runs through Shopify's native billing API, on your Shopify invoice, not a separate card payment. Payment details stay with Shopify.
- Anything past the stored list. Sync bookkeeping records when your store last synced, whether the stock came from Shopify or sample data, how much of the catalogue it read and any sync error. No product or order content beyond the fields in the table above.
- Your clicks. The only record of how you use the app is the list of setup steps your account has reached and when, kept so a stalled setup can be fixed. There is no behavioural tracking past that.
The narrower the grant, the less there is to worry about if anything ever goes wrong at the app's end. That is the whole argument for reading three feeds and stopping there.
Questions
What permissions does Restoc ask for?
Read access to your products and their variants, your inventory levels and your orders. That is the list. The Admin API access token it stores is used for that reading and to verify the webhook deliveries Shopify signs with the app's secret key. Read only on those three feeds, with no write access to your catalogue or your stock.
Does the app place the reorder for me?
No. Restoc reads the three feeds and acts by telling you. When a SKU crosses its reorder point you get an email alert, or a Slack message through a webhook on Growth and above. The weekly report lists every SKU below its reorder point with a suggested order quantity, viewable in-app and exportable as CSV. Placing the purchase order stays with you and your supplier.
Why does it need my order history and not just stock levels?
Stock on hand alone cannot tell you when to reorder. The reorder point comes from sales velocity over a window you pick, 7, 14 or 30 days, set against the lead time you enter per SKU or per vendor, with a store-wide safety stock percentage on top if you want cover for items that sell in bursts. That needs sales quantities and dates per SKU, which is what Restoc reads from your orders. The page on setting a reorder point in Shopify shows the arithmetic.
Why does it read the vendor on each product?
Because lead time is a supplier fact, not a SKU fact. Restoc reads the vendor field Shopify already holds on each product during the scheduled sync, then lets you save one lead time per vendor that fills every SKU under it without a lead time of its own. Nothing is written back to Shopify, and a SKU with its own lead time keeps it. It is the same product read, put to a second use.
Does it see my customers' names, addresses or card details?
No. From an order, Restoc stores the quantity sold, the date and the Shopify order reference against the SKU. No customer names, addresses or payment details are stored, and no product or order content beyond the fields listed above. Your subscription is billed by Shopify on your Shopify invoice, so payment details stay with Shopify.
What happens to my data when I uninstall or close the account?
Settings > Account deletes your account in one action. That removes the Shopify connection and its access token, plus every SKU, sales record, alert and report. Any active Shopify charge is cancelled first. Uninstalling from your Shopify admin also ends billing, and Shopify's data-erasure request about 48 hours later deletes the store's data here automatically.
Where does the data sit once it leaves Shopify?
On Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront and the Postgres database stays in its region. Reorder alert and account emails go out through Amazon SES. Slack receives alerts only at a webhook you configure yourself, so Shopify, AWS and Slack are the services involved.
What security measures are not in place yet?
Said plainly: no independent security audit, and no certification such as SOC 2 or ISO 27001. Sign-in is email and password, with no single sign-on and no two-factor authentication. There is no standing data processing agreement, so ask if you need one signed. There is no choice of data region. Better to know that before install than after.