starship / search / ampify-me

Audit report

Ampify Me AMP

Broad accessReach : moderateSensitive Access

by Ampify Me · Store design · Shopify App Store

Store design

Risk level

Broad access

Executive summary

"Amp up" performance and get more customers with Google AMP

Key insights

◆App carries the 'Built for Shopify' badge indicating compliance with Shopify platform standards.
◆Strong rating (4.9/5 from 41 reviews) and long-standing presence (launched May 2018).
◆Primary risk vector: app sends store/brand data to multiple external AI/LLM providers (ChatGPT, Claude, Gemini, Co-Pilot, Perplexity) with no clear disclosure of what data is shared or retention controls.
◆Publisher Ampify Pte. Ltd. is a Singapore-based entity; site appears to be hosted on Shopify infrastructure (powered-by: Shopify header).

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

"Amp up" performance and get more customers with Google AMP

Key insights

◆App carries the 'Built for Shopify' badge indicating compliance with Shopify platform standards.
◆Strong rating (4.9/5 from 41 reviews) and long-standing presence (launched May 2018).
◆Primary risk vector: app sends store/brand data to multiple external AI/LLM providers (ChatGPT, Claude, Gemini, Co-Pilot, Perplexity) with no clear disclosure of what data is shared or retention controls.
◆Publisher Ampify Pte. Ltd. is a Singapore-based entity; site appears to be hosted on Shopify infrastructure (powered-by: Shopify header).
◆No CVE history or publicly known security incidents tied to publisher.
◆Privacy policy uses standard SCCs for international transfers but lacks named sub-processors and explicit retention windows.

Detections

Findings (6)

Risks detected through static, network, and policy analysis.

Access to store owner PII (name, email, phone, address)

Medium

App requires access to store owner personal information per Shopify App Store listing. Without explicit consent management or minimization noted, this represents elevated risk.

Evidence

https://apps.shopify.com/ampify-me

No compliance certifications disclosed

Medium

Privacy policy does not reference GDPR adequacy decisions, SOC2, ISO 27001, PCI-DSS, or HIPAA. While SCCs are mentioned for cross-border transfers, no third-party audit certifications are listed.

Evidence

https://ampifyme.com/privacy

No defined data retention timelines

Low

Privacy policy uses a flexible retention model with no explicit timelines (e.g., 30 days, 1 year), which weakens GDPR Article 5(1)(e) compliance posture.

Evidence

https://ampifyme.com/privacy

Sub-processors disclosed only as categories, not named

Low

Privacy policy lists vendor categories (IT, payment, analytics, cloud) but does not provide a specific named sub-processor list, reducing transparency for DPIA purposes.

Evidence

https://ampifyme.com/privacy

App processes data via multiple AI/LLM platforms but privacy policy is silent

Low

App description states it tracks brand visibility across ChatGPT, Claude, Gemini, Co-Pilot, and Perplexity, yet the privacy policy makes no mention of AI/LLM data processing or what merchant/store data is sent to these third-party AI providers.

Evidence

https://apps.shopify.com/ampify-me

Minimal Content Security Policy on publisher site

Info

Publisher domain ampifyme.com (hosted on Shopify) returns a minimal CSP header (only block-all-mixed-content, frame-ancestors 'none', upgrade-insecure-requests). HSTS is enabled but with a relatively short max-age (~91 days).

Evidence

https://ampifyme.com/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	Medium	Implied by app functionality (visibility tracking), not explicitly confirmed in listing but typical for SEO/optimization apps.
`read_products`	Low	Explicitly listed: app accesses product and collection data to optimize for AI assistant visibility.
`read_customers`	High	Implied by access to store owner PII (name, email, phone, address) as disclosed in listing.
`read_content`	Low	Likely needed to access custom metaobjects mentioned in app description.

read_orders

Medium

Implied by app functionality (visibility tracking), not explicitly confirmed in listing but typical for SEO/optimization apps.

read_products

Low

Explicitly listed: app accesses product and collection data to optimize for AI assistant visibility.

read_customers

High

Implied by access to store owner PII (name, email, phone, address) as disclosed in listing.

read_content

Low

Likely needed to access custom metaobjects mentioned in app description.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

ampifyme.com

unknown · App backend / dashboard

Declared

openai.com

US · ChatGPT visibility queries

Declared

anthropic.com

US · Claude visibility queries

Declared

google.com

US · Gemini visibility queries

Declared

perplexity.ai

US · Perplexity visibility queries

Declared

Sub-processors

Data residency: unknown

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: ampifyme.com
TLS grade: unknown
HSTS: Enabled
CSP: Enabled

Publisher domain hosted on Shopify (Cloudflare-fronted). HSTS max-age=7889238 (~91 days, below the recommended 1 year). CSP is minimal, only block-all-mixed-content, frame-ancestors 'none', upgrade-insecure-requests. No script-src or default-src restrictions.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy mentions Standard Contractual Clauses for EEA/UK transfers but no formal certifications (SOC2, ISO27001, PCI-DSS, HIPAA) are listed. GDPR compliance not explicitly claimed.

Track record

Publisher reputation

Publisher: Ampify Me
Verified Shopify Partner: Yes
Years active: 8
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

LLM providers

OpenAI (ChatGPT)Anthropic (Claude)Google (Gemini)Microsoft (Co-Pilot)Perplexity

Data shared with providers

Brand and product information sent to multiple LLM providers via API queries to test AI visibility, no specific data minimization disclosure in privacy policy.

Retention policy

unknown