starship / search / acumbamail

Audit report

Acumbamail

Broad accessReach : moderateSensitive Access

by Acumbamail · Store design · Shopify App Store

Store design

Risk level

Broad access

Executive summary

Improve your shop with automated email marketing

Key insights

◆Spanish (EU) email marketing SaaS based in Ciudad Real, Spain; data residency is primarily EU
◆Shopify app is brand-new: 0 reviews, no Built for Shopify badge
◆Privacy policy is detailed, GDPR-aligned, lists DPO (Audisec/GlobalSuite) and TeamSystem group sub-processors
◆Publisher domain serves HTTPS with HSTS but lacks CSP

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Improve your shop with automated email marketing

Key insights

◆Spanish (EU) email marketing SaaS based in Ciudad Real, Spain; data residency is primarily EU
◆Shopify app is brand-new: 0 reviews, no Built for Shopify badge
◆Privacy policy is detailed, GDPR-aligned, lists DPO (Audisec/GlobalSuite) and TeamSystem group sub-processors
◆Publisher domain serves HTTPS with HSTS but lacks CSP
◆Mentions 'AI-based functionalities' (phishing detection, content assist) without naming specific LLM providers
◆Historical WordPress plugin CVE exists for the publisher, no Shopify-specific incidents found
◆Categories: Email marketing, Pop-ups, typical scope expectation: read_customers, read_products (not explicitly declared on listing page)

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Historical WordPress plugin vulnerability (not Shopify app)

Low

WordPress Plugin Acumbamail v1.0.4 had an information disclosure / MitM vulnerability (CWE-200). This affects the legacy WordPress plugin, not the Shopify app, but indicates past vulnerability history in publisher code.

Evidence

https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-acumbamail-information-disclosure-1-0-4/

No Shopify-specific security incidents found

Info

Web searches returned no public breach, leak, or incident specific to Acumbamail's Shopify app or the Acumbamail SaaS platform.

Brand-new Shopify listing with zero reviews

Low

The app has 0 reviews and 0.0 rating, indicating very limited install base and no community-based reputation signal to evaluate.

Evidence

https://apps.shopify.com/acumbamail

AI-based functionalities declared in privacy policy

Low

Privacy policy mentions 'AI-based functionalities' used for phishing detection and content creation assistance, but does not name specific LLM providers or sub-processors, reducing transparency on AI data flows.

Evidence

https://acumbamail.com/en/privacy-policy/

Missing Content-Security-Policy on publisher domain

Low

Publisher domain returns no Content-Security-Policy header. HSTS is present (max-age=31536000) but CSP would harden against XSS/injection in the customer-facing dashboard.

Evidence

https://acumbamail.com/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Email marketing requires customer email/profile data; typical scope for this category (not explicitly declared on listing)
`read_products`	Low	Required to sync product catalog into email templates per app description
`read_orders`	High	Likely needed for transactional/abandoned-cart email triggers per category norms

read_customers

High

Email marketing requires customer email/profile data; typical scope for this category (not explicitly declared on listing)

read_products

Low

Required to sync product catalog into email templates per app description

read_orders

High

Likely needed for transactional/abandoned-cart email triggers per category norms

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

acumbamail.com

EU · Email marketing platform, store customer/product data for campaigns

Declared

google.com

US · YouTube embeds and Google Ads tracking (per privacy policy)

Declared

Sub-processors

Google LLC (YouTube, Google Ads)Audisec/GlobalSuite Solutions (DPO)TeamSystem Group (Software Del Sol, Billin, Aplifisa, Marclamara, Ticcyl Digital, Golden Soft, My Expenses)

Data residency: EU

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: acumbamail.com
TLS grade: A
HSTS: Enabled
CSP: Missing

HTTPS clean with HSTS (max-age=31536000) and X-Frame-Options SAMEORIGIN; no Content-Security-Policy header observed

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

GDPR-aligned (EU-based), ENS certification badge displayed, EU-US Data Privacy Framework for transfers; no SOC2/ISO27001/PCI DSS claimed

Track record

Publisher reputation

Publisher: Acumbamail
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

●WordPress plugin Acumbamail v1.0.4 information disclosure / MitM vulnerability (CWE-200), legacy, not Shopify

LLM exposure

AI / LLM usage

LLM providers

Data shared with providers

Privacy policy mentions AI systems used for phishing detection in SMS/email and content creation assistance; specific data shared and providers not disclosed

Retention policy

Inherits platform retention: contractual data kept for service duration + statute of limitations; marketing data until objection