starship / search / ako-retargeting

Audit report

Ako Retargeting ‑ Facebook Ads

Broad accessReach : broadSensitive Access

by Akohub · Marketing · Shopify App Store

Marketing

Risk level

Broad access

Executive summary

Turn visitors into customers with FB & Instagram Retargeting

Key insights

◆Built for Shopify certified app with 4.9/5 rating across 109 reviews and long history (launched Nov 2016), established publisher signal.
◆Scope footprint is broad (customers, orders, products, discounts, analytics, staff) which is normal for loyalty+CRM+retargeting but creates a wide blast radius.
◆Publisher claims ISO 27001 and SOC 2 hosting but provides no certificate references, sub-processor list, data residency, or retention schedule.
◆Heavy outbound integrations to ad networks (Meta, Google, LINE) and Klaviyo, merchants should review their own DPA chain.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Turn visitors into customers with FB & Instagram Retargeting

Key insights

◆Built for Shopify certified app with 4.9/5 rating across 109 reviews and long history (launched Nov 2016), established publisher signal.
◆Scope footprint is broad (customers, orders, products, discounts, analytics, staff) which is normal for loyalty+CRM+retargeting but creates a wide blast radius.
◆Publisher claims ISO 27001 and SOC 2 hosting but provides no certificate references, sub-processor list, data residency, or retention schedule.
◆Heavy outbound integrations to ad networks (Meta, Google, LINE) and Klaviyo, merchants should review their own DPA chain.
◆No public security breaches, CVEs, or incidents found for Akohub or Ako Retargeting.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Broad write/edit scopes across products, orders, discounts, customers

Medium

App requests comprehensive store editing permissions across products, orders, discounts, and analytics, plus customer and staff data. This is a wide blast radius for a loyalty + retargeting app and elevates impact if the publisher is compromised.

Evidence

https://apps.shopify.com/ako-retargeting

Privacy policy lacks data residency, sub-processor list, and retention schedule

Medium

Privacy policy claims ISO 27001 / SOC 2 hosting but does not disclose data storage regions, named sub-processors (Meta, Google, Klaviyo, etc. are integrated but not listed), or retention timelines. Reduces auditability for GDPR Art. 28 / Art. 30 obligations.

Evidence

https://akohub.com/privacy-policy

Outbound data sharing to ad networks (Meta/Google) not detailed

Low

App integrates with Facebook Ads, Google Ads, Instagram, Klaviyo and LINE for retargeting. Customer data flows to third-party ad platforms but the policy does not enumerate fields shared, purpose limitation, or DPA references.

Evidence

https://apps.shopify.com/ako-retargeting

Publisher domain missing CSP header

Info

akohub.com responds with HSTS, X-Content-Type-Options, X-XSS-Protection but no Content-Security-Policy. Site is Shopify Oxygen/Hydrogen hosted, low direct risk to merchants but reduces defense-in-depth.

Evidence

https://akohub.com/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Customer PII (names, emails, addresses) used for loyalty membership and retargeting audiences.
`write_customers`	High	Loyalty tier / store credit assignment requires modifying customer records.
`read_orders`	High	Order history needed for points accrual and segmentation.
`write_orders`	High	Store credit redemption and reward application modify orders.
`read_products`	Medium	Product-specific redemptions and catalog targeting.
`write_products`	Medium	Used for product-specific reward or tagging mechanics.
`read_discounts`	Medium	Reward distribution via discount codes.
`write_discounts`	High	App creates discount codes; abuse could enable revenue loss if compromised.
`read_analytics`	Medium	Reporting for loyalty and retargeting performance.
`read_users`	Medium	Staff/user info referenced in app data access description.
`read_customer_browsing`	High	Browsing behavior used to build retargeting audiences.

read_customers

High

Customer PII (names, emails, addresses) used for loyalty membership and retargeting audiences.

write_customers

High

Loyalty tier / store credit assignment requires modifying customer records.

read_orders

High

Order history needed for points accrual and segmentation.

write_orders

High

Store credit redemption and reward application modify orders.

read_products

Medium

Product-specific redemptions and catalog targeting.

write_products

Medium

Used for product-specific reward or tagging mechanics.

read_discounts

Medium

Reward distribution via discount codes.

write_discounts

High

App creates discount codes; abuse could enable revenue loss if compromised.

read_analytics

Medium

Reporting for loyalty and retargeting performance.

read_users

Medium

Staff/user info referenced in app data access description.

read_customer_browsing

High

Browsing behavior used to build retargeting audiences.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

akohub.com

unknown · App backend / dashboard

Declared

facebook.com

US · Meta Ads retargeting audience sync

Declared

google.com

US · Google Ads retargeting audience sync

Declared

klaviyo.com

US · Email marketing integration

Declared

line.me

JP · LINE messaging integration

Declared

Sub-processors

Data residency: unknown

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: akohub.com
TLS grade: A
HSTS: Enabled
CSP: Missing

HSTS max-age=31536000 set; X-Content-Type-Options nosniff, X-XSS-Protection set; no CSP header observed. Cloudflare-fronted Shopify Oxygen/Hydrogen site.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy mentions ISO 27001 and SOC 2 only as hosting provider standards, not as Akohub-held certifications. No GDPR/PCI/HIPAA language. No retention schedule, no named sub-processors, no data residency disclosure.

Track record

Publisher reputation

Publisher: Akohub
Verified Shopify Partner: Yes
Years active: 10
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.