Technical and organisational measures (TOM)
Annex 1 to the Data Processing Agreement (DPA) pursuant to Art. 32 GDPR – Stockaro
1. Access control
- Authentication: access to the app exclusively via Shopify OAuth. There are no separate passwords and no separate user directory that could be compromised.
- Session: HMAC-SHA256-signed session tokens (shop domain, expiry, CSRF token), signed with a key held in the environment variables. No access without a valid signature.
- Tenant separation: every table carries a shop identifier and every database query filters on it. By construction, a merchant cannot see another merchant's data.
- Administrative access: operational access is limited to the provider and secured through the hosting platform.
2. Transmission and storage control
- Transport encryption: all connections to the app and to the Shopify API exclusively over TLS.
- Data at rest: database, backups and volumes reside on the hosting provider's platform and are stored encrypted there. We do not claim specific algorithms on our own authority, as we cannot verify them ourselves; the Railway DPA and the provider's security documentation govern.
- Access tokens: Shopify tokens are stored encrypted and revoked on uninstallation.
- Secrets: never in source code or logs, exclusively as environment variables of the hosting platform.
3. Data minimisation
- The following are not stored from Shopify end-customer data: email addresses, phone numbers, billing addresses, payment and credit card data.
- Camera frames from the barcode scanner are processed exclusively locally in the merchant's browser and are not transmitted to the server.
- The app log holds SKUs and reference IDs, no personal data.
- Protected Customer Data access at Shopify is limited to the fields actually required.
4. Availability and recoverability
- Hosting: Railway, region EU-West (Amsterdam, Netherlands), with automatic restart on crash.
- Backups: database backups in the hosting platform's cycle — daily (retained 6 days) and weekly (retained one month). The cycles are fixed by Railway.
- Merchant's own backup: the merchant can export inventory and movement data as CSV at any time. The app does not replace the merchant's own backup system.
5. Input and traceability control
- Every inventory booking is logged with timestamp, source and sign, and is visible in the merchant's log.
- Inventory changes run through a queue with retry logic; failed operations remain visible instead of being lost silently.
- The GDPR webhooks are logged with topic, shop domain and timestamp.
6. Separation of processing purposes
No cross-merchant analysis takes place. Data is not used for advertising, profiling or disclosure to third parties — except to the service providers named in the sub-processor list, to the extent described there.
7. Breach notification
Personal data breaches affecting the merchant's data are reported to the merchant without undue delay, at the latest within 48 hours of becoming aware (Art. 33(2) GDPR), so that the merchant can meet their own 72-hour deadline towards the supervisory authority.
8. Deletion
Deletion is triggered by Shopify's GDPR webhooks and takes place without undue delay after they are received; details and the option of return are set out in the DPA.
9. Limits of these measures
The provider is a one-person operation. Measures that presuppose an organisational separation of duties — four-eyes principle for operational access, separate roles for development and operations, an appointed data protection officer — therefore do not exist. This is stated openly here rather than hidden behind general wording. At the same time, the number of persons with access is minimal.
Last updated: 2026-08-12