starship / search / by-the-numbers

Audit report

By the numbers

Broad accessReach : moderateSensitive Access

by Unsupervised LLC · Reporting · Shopify App Store

Reporting

Risk level

Broad access

Executive summary

Metrics, forecasting and prediction tools for your business

Key insights

◆Built for Shopify certified analytics app by Unsupervised LLC with 4.9/5 rating (79 reviews).
◆EU data residency by default, AES-256 at rest, TLS 1.2+ in transit, GDPR DPA available on request.
◆Uses OpenAI for the 'AI Analyst' feature, customer/store data leaves Shopify boundary to a US LLM provider.
◆No publicly disclosed breaches, CVEs, or incidents tied to Unsupervised LLC or bythenumbersapp.com.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Metrics, forecasting and prediction tools for your business

Key insights

◆Built for Shopify certified analytics app by Unsupervised LLC with 4.9/5 rating (79 reviews).
◆EU data residency by default, AES-256 at rest, TLS 1.2+ in transit, GDPR DPA available on request.
◆Uses OpenAI for the 'AI Analyst' feature, customer/store data leaves Shopify boundary to a US LLM provider.
◆No publicly disclosed breaches, CVEs, or incidents tied to Unsupervised LLC or bythenumbersapp.com.
◆Publisher domain on Vercel with HSTS enabled (max-age=63072000); no CSP header observed at root.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Broad customer PII access scope

Medium

App requests access to customer names, emails, phone numbers, physical addresses, geolocation, IP addresses, and browsing behavior. Justified for analytics/segmentation use case but represents a sizable PII surface.

Evidence

https://apps.shopify.com/by-the-numbers

Customer data sent to OpenAI for AI Analyst feature

Medium

App's ChatGPT-style 'AI Analyst' uses OpenAI's API; relevant store/customer data is sent to OpenAI for processing. Sub-processor relationship and retention terms with OpenAI not explicitly disclosed on public security page.

Evidence

https://www.delightchat.io/apps/by-the-numbers

Data exported to multiple ad platforms

Low

Customer segments can be synced to Meta, Google, Klaviyo, and TikTok, expanding the downstream data flow surface. Merchant controls this, but it should be reviewed in any DPIA.

Evidence

https://apps.shopify.com/by-the-numbers

No public SOC2/ISO27001 attestation found

Info

Security page covers TLS 1.2+, AES-256 at rest, EU data residency, and GDPR DPA on request, but does not advertise SOC 2 Type II, ISO 27001, PCI DSS, or HIPAA attestations.

Evidence

https://www.bythenumbersapp.com/security/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	PII access (name, email, phone, address), needed for segmentation but high-impact if compromised.
`read_orders`	High	Full order history required for CLV/RFM/cohort analysis.
`read_all_orders`	High	Likely needed for historical analytics beyond 60 days.
`read_products`	Low	Catalog data for product-level analytics.
`read_marketing_events`	Medium	Marketing event data for ROAS/CAC reporting.
`read_analytics`	Medium	Store analytics for dashboarding.
`read_pixels`	Medium	Web pixel access to track on-store behavior (IP, geo, browser).
`read_customer_events`	Medium	Behavioral event stream for segmentation.

read_customers

High

PII access (name, email, phone, address), needed for segmentation but high-impact if compromised.

read_orders

High

Full order history required for CLV/RFM/cohort analysis.

read_all_orders

High

Likely needed for historical analytics beyond 60 days.

read_products

Low

Catalog data for product-level analytics.

read_marketing_events

Medium

Marketing event data for ROAS/CAC reporting.

read_analytics

Medium

Store analytics for dashboarding.

read_pixels

Medium

Web pixel access to track on-store behavior (IP, geo, browser).

read_customer_events

Medium

Behavioral event stream for segmentation.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

bythenumbersapp.com

EU · App backend / analytics processing

Declared

api.openai.com

US · AI Analyst (LLM) query processing

Declared

graph.facebook.com

US · Meta audience sync (merchant-initiated)

Declared

googleads.googleapis.com

US · Google audience sync (merchant-initiated)

Declared

a.klaviyo.com

US · Klaviyo audience sync (merchant-initiated)

Declared

business-api.tiktok.com

US · TikTok audience sync (merchant-initiated)

Declared

Sub-processors

ShopifyOpenAIKlaviyoMetaGoogleTikTokCloud infrastructure provider (undisclosed)Email service provider (undisclosed)

Data residency: EU

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: bythenumbersapp.com
TLS grade: A
HSTS: Enabled
CSP: Missing

HSTS max-age=63072000 enabled at root; no Content-Security-Policy header observed on landing page. Site hosted on Vercel.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

GDPR data processor with DPA available on request. No public SOC 2 / ISO 27001 / PCI / HIPAA attestation. Encryption: TLS 1.2+ in transit, AES-256 at rest, separate keys for DB backups in managed vault.

Track record

Publisher reputation

Publisher: Unsupervised LLC
Verified Shopify Partner: Yes
Years active: 8
Other apps: 1

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

LLM providers

OpenAI

Data shared with providers

Relevant store, customer, and order data is sent to OpenAI for the AI Analyst feature to produce context-aware analyses.

Retention policy

Not explicitly disclosed on public security page; OpenAI API default terms apply unless a custom DPA is in place.