starship / search / affiliate

Audit report

Affiliate by AAAecommerce

Broad accessReach : moderateSensitive Access

by AAAeCommerce Inc · Marketing · Shopify App Store

Marketing

Risk level

Broad access

Executive summary

Affiliate Marketing - Promote Products with your Affiliates

Key insights

◆Affiliate marketing app published by AAAeCommerce Inc, live since February 2018
◆Very low merchant traction: 2.0 stars / 4 reviews
◆Privacy policy explicitly disclaims PCI DSS and HIPAA compliance
◆Data transferred to Canada, United States, and India

Top findingsview all

High
Publisher self-attests non-compliance with PCI DSS and HIPAA

Synthesis

Analysis summary

Affiliate Marketing - Promote Products with your Affiliates

Key insights

◆Affiliate marketing app published by AAAeCommerce Inc, live since February 2018
◆Very low merchant traction: 2.0 stars / 4 reviews
◆Privacy policy explicitly disclaims PCI DSS and HIPAA compliance
◆Data transferred to Canada, United States, and India
◆Publisher infrastructure runs end-of-life PHP 7.4 on LiteSpeed (Hostinger)
◆No HSTS; CSP limited to upgrade-insecure-requests
◆No public CVEs or breach reports found for publisher or app
◆No AI/LLM usage disclosed

Detections

Findings (6)

Risks detected through static, network, and policy analysis.

Publisher self-attests non-compliance with PCI DSS and HIPAA

High

AAAeCommerce privacy policy explicitly states 'Services are neither HIPAA nor PCI DSS compliant'. While the app may not directly process card data, the explicit non-compliance disclosure suggests limited formal security governance.

Evidence

https://www.aaaecommerce.com/pages/privacy-policy

Data transferred to multiple jurisdictions including India without explicit safeguards

Medium

Personal information may be transferred to Canada, United States, and India. The policy does not detail SCCs, adequacy decisions, or other safeguards for cross-border transfers, which may pose GDPR concerns for EU merchants.

Evidence

https://www.aaaecommerce.com/pages/privacy-policy

Publisher website runs outdated PHP 7.4 (EOL November 2022)

Medium

Server response headers show x-powered-by: PHP/7.4.33. PHP 7.4 reached end-of-life on 28 November 2022 and no longer receives security patches, indicating poor patch hygiene on publisher infrastructure.

Evidence

https://www.aaaecommerce.com/

Missing HSTS and weak Content-Security-Policy on publisher domain

Medium

Publisher website does not return Strict-Transport-Security header and CSP is limited to 'upgrade-insecure-requests' only, providing minimal XSS or injection mitigation.

Evidence

https://www.aaaecommerce.com/

Very low rating and minimal review volume

Low

App has 2.0 rating with only 4 reviews, indicating low merchant adoption and limited public scrutiny of the security posture in production.

Evidence

https://apps.shopify.com/affiliate

Not 'Built for Shopify' certified

Info

The app does not carry the Built for Shopify badge, meaning it has not passed Shopify's enhanced quality and performance criteria.

Evidence

https://apps.shopify.com/affiliate

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Affiliate apps typically need customer data to attribute referrals and process commissions (scope inferred from category; not explicitly listed on App Store page accessed).
`read_orders`	High	Required to detect affiliate-attributed orders and calculate commissions per order (inferred from $0.50 per affiliate order pricing model).
`write_discounts`	High	App offers 'Instagram discount code sharing' and custom commission setup, implying creation/management of discount codes (inferred).
`read_products`	Medium	Needed to associate affiliate links/commissions with products (inferred).

read_customers

High

Affiliate apps typically need customer data to attribute referrals and process commissions (scope inferred from category; not explicitly listed on App Store page accessed).

read_orders

High

Required to detect affiliate-attributed orders and calculate commissions per order (inferred from $0.50 per affiliate order pricing model).

write_discounts

High

App offers 'Instagram discount code sharing' and custom commission setup, implying creation/management of discount codes (inferred).

read_products

Medium

Needed to associate affiliate links/commissions with products (inferred).

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

aaaecommerce.com

unknown · Publisher primary domain / app backend

Declared

google.com

US · Analytics / advertising third party

Declared

facebook.com

US · Social integration / advertising third party

Declared

bing.com

US · Advertising third party

Declared

sourceknowledge.com

unknown · Marketing/attribution third party

Declared

Sub-processors

GoogleFacebookBingSourceKnowledgeUnspecified subcontractors

Data residency: unknown

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: aaaecommerce.com
TLS grade: A
HSTS: Missing
CSP: Missing

HTTP/2 reachable, HTTPS upgrade enforced via CSP 'upgrade-insecure-requests' but no HSTS header. Server discloses outdated PHP 7.4.33 (EOL Nov 2022) on LiteSpeed/Hostinger.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy explicitly states services are neither HIPAA nor PCI DSS compliant. No SOC2 or ISO27001 attestation mentioned. GDPR not explicitly addressed for cross-border transfers to India.

Track record

Publisher reputation

Publisher: AAAeCommerce Inc
Verified Shopify Partner: No
Years active: 8
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.