Sensitive data access

What every store gets

Regardless of plan, Randio stores customers' names, phone numbers and address fields encrypted at rest, keeps an audit trail of actions taken in the app, and only ever emails customers who have marketing consent. Shopify's compliance requests (data access, customer erasure, store erasure) are honoured automatically.

On a Shopify App Store install

Nothing is masked inside Randio. Every staff member you gave app access in your Shopify admin sees customer details and financial figures alike, because Shopify's app access is the whole access decision. See Who can use Randio.

Data permissions on custom plans

For stores where Randio manages the accounts, three data permissions decide what a team member sees:

• Financial (financial.view): revenue, order totals, average order value and commission.
• Personal information (pii.view): customer names, email addresses, phone numbers and addresses.
• Billing (billing.view): the plan and the bill. Owner only.

Role presets set these deliberately: Analyst has financial and personal data, Strategist and Designer have neither. Check them when you create a custom role; the role editor lists them as access to financial data, personal information and billing.

Account security on custom plans

The Settings tabs that only custom plans see: Security (an IP allowlist for admin sign-in and API access, and a switch to grant Randio support temporary access for 24 hours), Sessions (every signed-in device, with sign-out), Audit log (who did what, when), and Account (password, two-factor authentication, and the team users toggle). On an App Store install, Shopify's own staff security covers these.

Related: Permission categories.