Your shop data isnobody else’s business.
Connecting Stockaroo means handing over access to every shopfront you run. That is a lot to ask, so here is what happens to it — in plain terms, without needing to be technical.
Your data sitsin its own place.
- Not in a shared pile
- Most software keeps every customer in one big database and relies on filtering to keep you apart. We do not. Your account gets its own database, so another Stockaroo customer cannot see your orders even if something goes wrong in our code.
- You cannot wander into someone else’s account
- Which account you are is decided from your sign-in, checked again by every part of the system, and cannot be changed by editing a web address. Changing a number in a URL does not show you anyone else’s anything.
- Your team, your rules
- Staff accounts see what you allow them to see, and that is enforced on our servers — not by hiding a button in the browser.
We never learnyour shop passwords.
StockarooConnections
Stockaroo
eBay
Sync listings, orders and stock with your eBay account
Amazon
Sync listings, orders and stock with Seller Central
- You sign in at their site, not ours
- Connecting eBay, Amazon, TikTok Shop, Etsy or Shopify sends you to that marketplace to approve access. You type your password on their page. We never see it and never store it.
- The access we do hold is encrypted
- The permission each marketplace grants us is stored encrypted (AES-256-GCM), not sitting in a database as readable text.
- WooCommerce works differently
- WooCommerce is the exception: there is no marketplace sign-in to send you to, so you create an API key in your own WordPress admin and paste it in. You decide what that key can do, and you can revoke it from WordPress at any time.
- You can revoke it whenever you like
- Disconnect a channel in Stockaroo and its access is removed. You can also revoke us from the marketplace’s own settings, and we stop having access immediately.
Getting into your accountis meant to be hard.
- Passwords
- Stored hashed with bcrypt, which means we cannot read yours and neither could anyone who obtained the file. We never email it to you, because we cannot.
- Repeated guessing gets shut down
- Too many failed sign-ins locks the account for a period, and sign-in, sign-up and password-reset attempts are all rate limited. We do not publish the thresholds — telling everyone exactly where the line sits mostly helps the people trying to stay under it.
- The login form gives nothing away
- A wrong password and an email that has never registered produce exactly the same response, so the form cannot be used to work out who has an account.
- Everything in transit is encrypted
- HTTPS between you and us, and between us and every marketplace and courier. Session cookies cannot be read by scripts and are not sent to other sites.
- We never see your card
- Paying sends you to Stripe’s own checkout page. Your card number is typed on Stripe’s site, not ours — we do not embed a payment form, so there is no card field on any Stockaroo page and nothing for us to leak. We get back a token that can charge your subscription and nothing else.
The unglamorous part.
- We log what our staff do
- If anyone here acts on your account, it is written to an audit record with who, when, from where, and what changed.
- Uploads are read, not kept
- A supplier stock file is parsed for the numbers and discarded. Nothing you upload is stored on our servers or served back out.
- Secrets stay out of the browser
- Nothing sensitive is embedded in the pages you load. The parts that matter run on our servers, where you cannot be tricked into leaking them.
- We would rather say "not yet" than "probably"
- We do not claim certifications we have not earned, and we do not offer an uptime guarantee, because we would rather not publish a number we are not measuring against.
The rest of it,written down.
- Who else touches your data
- Every third party we use is named on the sub-processors page, along with what it does and where it is. It is a short list, and the absences are deliberate.
- Found a problem?
- Our vulnerability disclosure policy explains how to report it, what we commit to in return, and the safe-harbour terms. There is a security.txt too.