30/90-day review reminders
30/90-day access-review reminders are not Shopify’s 90-day collaborator expiry
Shopify’s 90-day collaborator expiry is a platform rule: a collaborator account that has not logged in for 90 days automatically expires and must be Reactivated in Settings → Users. A 30- or 90-day review reminder is a separate review cadence you set for checking access, and a reminder that is overdue does not expire or Reactivate anyone.
Staff Access Audit Guard (Shopify App Store) is a Shopify app that reviews installed app access, granted scopes, staff access records, and ownership evidence without reading customer or order data. It tracks staff and collaborator access with 30/90-day review reminders, classifies granted scopes including AI and agentic apps, flags protected customer-data and broad-write access, and scores the store Low to High (higher is safer). It does not Reactivate collaborators, rotate Shopify’s inactivity clock, revoke users, or uninstall apps. Confirm live listing text rather than this page. This guide does not add prices. Not a security attestation.
Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.
Free check first: App access scope reader runs in your browser and sends nothing. Paste an app's access scopes and see which touch customer data or can write.
Two different clocks
Shopify’s 90-day collaborator expiry automatically expires unused collaborator access, and a 30- or 90-day review reminder that is overdue does not expire or Reactivate anyone. Shopify Help Center and the Access Audit Guard listing document two different jobs.
| Clock | What it does | What it does not do |
|---|---|---|
| Platform (Help Center) | If a collaborator has not logged in for 90 days, access can auto-expire. Restore on Users with Actions → Reactivate user — see 90-day collaborator expiry — Reactivate and Shopify Help Collaborator accounts. | Not staff Suspend. Not a reminder to re-check who should still have access. |
| App (listing) | Tracks staff and collaborator access with 30/90-day review reminders — a cadence to re-open who still should have access. | Reminder overdue is not platform expiry. The app does not expire access, Reactivate users, or rotate Shopify’s inactivity clock. |
An overdue 30/90-day reminder means the access inventory is due for another look. It does not mean Shopify already removed the collaborator.
What the reminder is for
Use the reminder to re-open the access inventory: staff, collaborators, and installed-app scopes.
Live listing (re-fetched at PR time, HTTP 200): “Review installed app access, granted scopes, staff access records, and ownership evidence without reading customer or order data.” Feature line: “Tracks staff and collaborator access with 30/90-day review reminders.”
The same listing also says: “Apps request scopes - including AI and agentic apps. This app classifies each granted scope, flags protected customer-data and broad-write access, and scores your store Low to High (higher is safer).”
That is a scored review of access you already granted. It is not a security attestation, and it is not employee monitoring.
Native hygiene still required
Reminders do not replace Settings → Users. Least privilege on Approve. Remove when the work ends. Rotate the collaborator request code so old Partners cannot re-request. Use Reactivate user only when restoring an expired collaborator — not Suspend, and not as a substitute for Remove when the relationship is over.
- Approve: grant only the permissions the job needs.
- Work ended: Remove collaborator account, not staff Suspend.
- Stop open requests: Generate new collaborator request code.
- Expired after 90 days without login: Actions → Reactivate user (or Remove + a new request).
Not the same as Suspend, the request code, or platform expiry
- Not Cannot suspend a collaborator — remove access instead. Collaborators cannot use staff Suspend; Remove is the native off-store control.
- Not Collaborator request code. The code gates who can ask for access; it does not fire a 30/90-day review reminder and it does not expire a logged-out collaborator.
- Not Shopify’s 90-day collaborator expiry. That is platform auto-expiry after 90 days without login, restored with Reactivate user.
- Not employee monitoring, field-level edit logs, or a promise that the store is secure.
App path: install, first audit, then treat reminders as the re-review trigger
Reactivate, Remove, and a new collaborator request stay in Settings → Users. After that native work — or instead of waiting for platform expiry — run an access and scope audit so staff, collaborators, and installed apps are still inventoried.
- Open the Staff Access Audit Guard listing (
apps.shopify.com/momiji-access-audit) and install it on the store that needs the review cadence. - Wait for the first audit — the listing states it runs on install — or run another now.
- Use the 30/90-day review reminders as the trigger to re-check staff, collaborators, granted scopes, and owners.
- Re-check apps that requested scopes, including AI and agentic apps, and any protected customer-data or broad-write access the listing flags. Higher score is safer.
The app scores and flags access you already granted. It does not Reactivate collaborators, rotate Shopify’s inactivity clock, revoke users, or uninstall apps. Confirm live listing text rather than this page.
What this page is not
- Not a security attestation, SOC report, or attorney advice.
- Not employee monitoring or a customer-data export.
- Not “the app expires collaborators after 90 days” and not “the app Reactivates them.”
Related pages
- App ownership evidence (scopes + owner) — installed-app table, not the staff user list
- Staff permission drift access audit — snapshot vs a recurring review
- 90-day collaborator expiry — Reactivate — platform inactivity clock; Actions → Reactivate user
- Cannot suspend a collaborator — remove access instead — staff Suspend vs collaborator Remove
- Collaborator request code — only Partners you share the code with can ask for access
- Leftover Admin access checklist — leavers with 2FA, collaborators vs the bill, preview vs publish
- Shopify Help Center — Collaborator accounts — 90-day expiry and Reactivate user
- Staff Access Audit Guard — live App Store listing
- Staff access audit install page
- Shopify apps hub — Staff Access Audit Guard
- Tools
Not a security attestation. Not employee monitoring. Native Settings → Users is the Reactivate and Remove control. The app’s 30/90-day reminders are a review cadence; they do not expire or Reactivate collaborators.