What Restoc reads from your store, where it is kept, and how to delete it
If you are vetting a Shopify inventory app before granting it API access, this is the whole answer: what Restoc reads from your store, where it is kept, which outside services touch it, and how to delete it. Restoc is still being built, so this describes the product as declared, including the parts that are honestly not in place yet.
What Restoc reads from your Shopify store
Restoc installs through Shopify's OAuth flow and reads three things: your products and their variants, inventory levels, and orders. That is the whole input. Inventory and sales arrive by Shopify webhooks plus a scheduled sync job, which is what lets a reorder point be calculated without you touching a spreadsheet.
From orders, Restoc keeps the quantity, the date and the Shopify order reference per SKU. It does not store customer names, customer addresses or payment details. Sales velocity needs to know how many units moved and when, nothing about who bought them.
Restoc is a web app. There is no mobile app and no browser extension, so there is no second place your store data gets copied to.
Every record stored, and the reason it exists
| What is stored | Why it is there |
|---|---|
| Your name, email address and a hash of your password | To sign you in. Reorder alerts are emailed to this address from the moment you connect a store, until you change it or switch email alerts off in Settings, Alerts. |
| Your store's .myshopify.com domain, a Shopify Admin API access token granted at install or pasted from your own custom app, and that app's API secret key | To read products, inventory levels and orders, and to verify the webhook deliveries Shopify signs with the secret key. Both are stored server-side and never shown in the app. |
| Sync bookkeeping: when your store last synced, whether its stock came from Shopify or sample data, how much of your catalogue it read, and any sync error | So a stalled or partial sync can be seen and fixed rather than quietly showing you stale stock. No product or order content beyond what is listed here. |
| Tracked SKUs: title, your own SKU code, Shopify variant id, current stock, lead time, computed reorder point | To work out days of inventory remaining and when each SKU crosses its reorder point. |
| Sales quantities and dates per SKU, with the Shopify order reference | To calculate sales velocity over your chosen window of 7, 14 or 30 days. No customer names, addresses or payment details are stored. |
| Your alert settings: the destination email address, and a Slack webhook URL if you set one | To deliver reorder alerts where you asked for them. |
| Your plan tier, trial end date and the state of your Shopify subscription charge | To know what your plan allows and whether the trial is still running. Payment details stay with Shopify and never reach us. |
Where it lives
Restoc is hosted on Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront; the Postgres database stays in its region.
One honest consequence: you do not get to pick that region. If your procurement checklist requires data residency in a named country, Restoc cannot satisfy it today, and we would rather you find that out on this page than three emails into a trial.
How people sign in
Sign-in is email and password. Your password is stored only as a hash, never in a form anyone here can read.
The address you sign in with is also the address reorder alerts go to until you change it in Settings, Alerts. Those alerts and any account email leave through Amazon SES, which runs inside the same Amazon Web Services account as the app, so no separate mail vendor holds your address.
What is not there: single sign-on and two-factor authentication. If your team mandates either before an app goes anywhere near your store, Restoc is not the right fit for now. We will say so plainly here when that changes.
Deleting your data, and how long it is kept otherwise
Deletion is one action, not a support ticket. Settings, Account in the app deletes your account and everything stored about your store at once: the Shopify connection and its access token, every SKU, every sales record, every alert and every report. Any active Shopify charge is cancelled first, so deleting does not leave a subscription running behind you.
Uninstalling from your Shopify admin also ends billing. Shopify then sends its data-erasure request about 48 hours later, and that deletes the store's data here automatically. You do not have to come back and tidy up.
Until you do one of those two things, data is kept while your account is open, because sales history is what feeds the velocity calculation. Deleting removes everything at once. There is no separate archive of your data to request, and none to forget about.
The outside services that touch your data
| Service | What it does |
|---|---|
| Shopify | The source of your products, inventory and orders, and the biller of your subscription on your Shopify invoice. |
| Amazon Web Services | Hosts the app and its Postgres database, and sends reorder alert and account emails through Amazon SES. Email alerts can be switched off in Settings, Alerts. |
| Slack | Receives reorder alerts at a webhook you configure, only if you enable Slack alerts. |
What is not in place yet
No independent audit or certification
There is no SOC 2 report and no ISO 27001 certificate. If your process requires one before install, Restoc will fail that gate today.
No single sign-on
Sign-in is email and password only. There is no SAML or Google workspace path in or out.
No two-factor authentication
Not built yet. It is the kind of thing we will say plainly when it ships, rather than imply it now.
No standing data processing agreement
There is no DPA sitting ready to counter-sign. Ask if you need one signed, and we will tell you where we stand.
No choice of data region
Your data sits in the single AWS region the app runs in, and you cannot move it.
Why the data set is deliberately small
A reorder alert needs four numbers: current stock, how fast a SKU sells, how long your supplier takes, and the reorder point those three produce. Everything in the table above exists to produce one of those four, or to deliver the alert, or to bill you through Shopify.
That is the whole argument for a small tool over a planning suite. A forecasting platform needs margins, costs, channels and customer cohorts. Restoc does not ask for any of them, so there is nothing extra to store, nothing extra to leak, and nothing extra to explain to a reviewer.
Three services, one host, one mail sender inside that host. A reviewer can read the list above in under a minute, which is the point.
Questions
Does Restoc store my customers' personal data?
No. From your orders it keeps the quantity sold, the date and the Shopify order reference per SKU. Customer names, addresses and payment details are not stored.
Where is my store's data hosted?
On Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront and the Postgres database stays in its region. You cannot choose the region.
Which service sends the alert emails?
Amazon SES, inside the same Amazon Web Services account that hosts the app and its database. Reorder alert emails and account email both leave that way, and email alerts can be switched off in Settings, Alerts.
Is Restoc SOC 2 or ISO 27001 certified?
No. There is no independent security audit and no certification. We will not imply otherwise while that is true.
What happens to my data if I uninstall the app from Shopify?
Uninstalling ends billing, and Shopify's data-erasure request about 48 hours later deletes the store's data here automatically. You can also delete immediately from Settings, Account in the app, which removes the connection, token, SKUs, sales records, alerts and reports at once and cancels any active Shopify charge first.
Can I delete everything myself without emailing support?
Yes. Settings, Account in the app deletes your account and all stored store data in one action. There is no separate archive left behind.
Can you sign our data processing agreement?
There is no standing DPA in place yet. Ask, and we will tell you plainly where we are rather than promise a signature we cannot give today.
Where are my card details kept?
With Shopify. Restoc stores your plan tier, trial end date and the state of your Shopify subscription charge, and the subscription appears on your Shopify invoice. Payment details never reach us.