Early access
Now open to Square sellers
Security
Security at Wintry
This page describes the measures we use to protect the data we back up from your Square account, and how to report a security issue to us.
Last updated 12 October 2026
In summary
Connecting to Square
Square’s own OAuth sign-in. We never see or store your password.
What we can access
Read permissions for daily backups. Write permissions only if you turn on restores, used only while a restore runs.
Encryption
Encrypted in transit and at rest, with Square tokens under a hardware-backed key.
Hosting and infrastructure
Google Cloud in Iowa, with soft-delete protection on every backup.
Access to your data
Authorised staff only, with two-factor sign-in.
Retention and deletion
Kept while you subscribe, then for 30 days after backups stop.
This page summarises how we keep your data secure. It describes our current practices, which may change as we improve them, and it is not part of our agreement with you. Our Terms of Service and Data Processing Agreement set out our commitments, and they apply if anything here differs.
01
Hosting and infrastructure
Google Cloud provides our cloud infrastructure, such as hosting and storage, in its us-central1 region in Council Bluffs, Iowa, United States.
Backups are stored with soft-delete protection, so backup files deleted by mistake can still be recovered.
The providers that can process your store data are listed on our Sub-processors page.
02
Connecting to Square
You connect through Square’s own OAuth 2.0 sign-in and approve each permission on Square’s page. We never see or store your Square password.
Daily backups only read your data. The table below lists every permission we ask for, what we use it for, and the access we never request.
Restore access is a separate opt-in approval. You can turn it off in Settings at any time and we stop using it straight away. Square keeps the permission until you disconnect your store.
Each object a restore writes gets its own short-lived OAuth 2.0 token with only the permission it needs. It is revoked once the write is done, and expires on its own if it can’t be revoked.
You can disconnect at any time in Wintry, or in your Square Dashboard under Settings > App integrations. Your backups are then kept for 30 days and deleted after that, as section 06 explains.
Read: used by daily backups
ITEMS_READ
INVENTORY_READ
CUSTOMERS_READ
LOYALTY_READ
GIFTCARDS_READ
INVOICES_READ
SUBSCRIPTIONS_READ
APPOINTMENTS_READ
APPOINTMENTS_ALL_READ
APPOINTMENTS_BUSINESS_SETTINGS_READ
EMPLOYEES_READ
Team members, their jobs and pay rates
TIMECARDS_READ
Timecards, including pay rates and declared tips, and scheduled shifts
TIMECARDS_SETTINGS_READ
MERCHANT_PROFILE_READ
PAYMENT_METHODS_READ
VENDOR_READ
DEVICES_READ
DEVICE_CREDENTIAL_MANAGEMENT
ONLINE_STORE_SITE_READ
Write: only if you turn on restore access, used only while a restore runs
ITEMS_WRITE
INVENTORY_WRITE
CUSTOMERS_WRITE
Never requested
PAYMENTS_READ, PAYMENTS_WRITE
ORDERS_READ, ORDERS_WRITE
PAYOUTS_READ
BANK_ACCOUNTS_READ
DISPUTES_READ, DISPUTES_WRITE
03
What we store
Copies of the Square data in the table above, kept as dated backups in JSON format, along with your catalog images.
Your name and email address, which you give when you sign up, or which Google or Apple shares if you sign in with them. Our sign-in provider holds them for your Wintry account.
A record of the backups and restores run on your account.
Your plan and billing status. Your payment card is held by our payment provider Stripe, not by us.
We never ask Square for your payments, payouts, orders or bank accounts, and Square never shares full payment card numbers with us. Gift card numbers are stored, because they are part of your gift card backups.
We don’t sell your data, use it for advertising, contact the people in it, or use it to train AI models.
04
Encryption
Square access and refresh tokens
Encrypted a second time with AES-256-GCM, using a key held in a hardware security module (HSM) in Google Cloud KMS (Key Management Service).
Handled by our authentication provider, which stores passwords only as one-way hashes. If you sign in with Google or Apple, no password is created for Wintry, because Google or Apple confirms who you are. Your password never reaches our servers.
05
Access to your data
Access to production systems is limited to authorised Wintry staff. Staff sign in with two-factor authentication, using hardware security keys for administrative access to Google Cloud, where sessions expire and require re-authentication.
We look at your store data only when you ask us for help, when we need to investigate a problem with the Service, or when the law requires it.
To investigate and fix errors we may use AI/ML services from our technology providers. We share only what an investigation needs, and they do not use your data to train their AI models. The providers that can process your store data are listed on our Sub-processors page.
06
Retention and deletion
While your plan is active and your store stays connected, we keep every backup.
If you disconnect, or your plan ends, including at the end of a billing period after you cancel, backups stop. Existing backups are kept for 30 days after your last backup or your disconnection, whichever is later. Reconnect or resubscribe in that time and you keep your backups.
After that, we delete your backups from our live systems within 120 days, and the recovery copies our storage keeps expire within a further 90 days. Section 11 of our Terms of Service has the details.
To close your account, email support@wintry.io. We then delete your account details, except records we keep as our Privacy Notice explains, and your backups on the schedule above.
You can ask for an export of your backups at any time by emailing support@wintry.io.
07
Monitoring and incidents
We monitor the service for errors and failed backups, and automatic checks run throughout the day to catch backups that are out of date, missing or damaged.
Temporary errors during a backup are retried automatically before the backup counts as failed, and your Home page shows the status of your latest backup.
If a security incident affects your data, we will email you without undue delay after becoming aware of it.
08
Report a vulnerability
Email security@wintry.io. We will acknowledge your report and keep you updated while we fix the issue.
Please stay within your own account’s data, avoid disrupting the service, and give us reasonable time to fix the issue before you disclose it. We will not take legal action against good-faith research that follows these guidelines. This covers Wintry’s own systems only, not Square or our other providers.
Found something? Tell us.
Email security@wintry.io. Good-faith research on Wintry’s own systems is welcome.