Security and your data

Last updated: 21 October 2026

Only the access we need

When you connect, we ask Square only for these permissions:

• MERCHANT_PROFILE_READ
• ITEMS_READ
• INVENTORY_READ
• ONLINE_STORE_SITE_READ
• ONLINE_STORE_SNIPPETS_READ
• ONLINE_STORE_SNIPPETS_WRITE

Your connection is encrypted

• You sign in on Square's own page. We never see your password.
• The access and refresh tokens Square gives us are encrypted with AES-256-GCM before they are stored. The key is kept as a separate secret, not in the database.
• Each sign-in uses a one-time, short-lived security code to block forged requests.
• Your session cookie is signed, HttpOnly and Secure, and works only on restockchime.com.
• All pages are served over HTTPS only, with strict security headers.

Verified on Stripe

Your RestockChime subscription is billed through Stripe, so card details are entered on Stripe and never on RestockChime. You can check our public Stripe business profile.

What we keep

We keep only what the product needs to work. Details are in our Privacy Policy.

How to disconnect

1. In RestockChime: open Settings and choose "Disconnect and delete my data". We revoke our access, cancel your plan at the end of the paid period and delete your data right away.
2. Or in Square: sign in to your Square Dashboard, go to Settings > App integrations, select the three dots next to RestockChime and choose Disconnect App. Square tells us, and we do the same.

Report a security problem

Email support@restockchime.com with "Security" in the subject. We read every report and reply as soon as we can.