Starship
starship / search / aftership-tracking

Audit report

AfterShip Order Tracking

Broad accessReach : broadSensitive Access

by AfterShip · Shipping · Shopify App Store

Built for ShopifyShippingv6.4.0
Risk level
Broad access
Executive summary

AfterShip est leader tracking post-achat. Risque Medium, accès orders + fulfillments pour le tracking + notifications, mitigé par SOC 2 et ISO 27001.

Key insights

  • ◆Tracking commande multi-carriers + notifications.
  • ◆Risque Medium, surface orders/fulfillments + emails clients.
  • ◆Built for Shopify. SOC 2 Type II + ISO 27001.
  • ◆Éditeur Hong Kong (sous HKEX: 9919).

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

AfterShip est leader tracking post-achat. Risque Medium, accès orders + fulfillments pour le tracking + notifications, mitigé par SOC 2 et ISO 27001.

Key insights
  • ◆Tracking commande multi-carriers + notifications.
  • ◆Risque Medium, surface orders/fulfillments + emails clients.
  • ◆Built for Shopify. SOC 2 Type II + ISO 27001.
  • ◆Éditeur Hong Kong (sous HKEX: 9919).
  • ◆Note 4,8 sur 4 870 avis.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_orders
High

Tracking.

read_fulfillments
Medium

État expédition.

read_customers
High

Notifications.

write_themes
High

Page tracking.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
aftership.com
TLS grade
A+
HSTS
Enabled
CSP
Enabled

TLS 1.3, HSTS, CSP.

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Pass
ISO 27001 Pass
PCI DSS Fail

SOC 2 Type II + ISO 27001 + GDPR + CCPA. DPA publique.

Privacy policy
Track record

Publisher reputation

Publisher
AfterShip
Verified Shopify Partner
Yes
Years active
14
Other apps
8
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.