starship / search / callexa-feedback

Audit report

Callexa NPS Feedback

TrustedReach : moderateSensitive Access

by OnDemand Web Solutions GmbH · Customer support · Shopify App Store

Customer support

Risk level

Trusted

Executive summary

Get valuable customer feedback with automated NPS surveys.

Key insights

◆EU-based publisher (Durmersheim, Germany) processing data in EU data centers, favorable for GDPR-bound merchants.
◆Mature product launched in 2017 with a small footprint (1 review, 5.0 rating) and no 'Built for Shopify' badge.
◆No known security incidents, CVEs, or data breaches found in public sources.
◆Privacy policy explicitly cites GDPR/BDSG compliance and EU data residency but lacks formal third-party attestations (SOC2/ISO27001).

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Get valuable customer feedback with automated NPS surveys.

Key insights

◆EU-based publisher (Durmersheim, Germany) processing data in EU data centers, favorable for GDPR-bound merchants.
◆Mature product launched in 2017 with a small footprint (1 review, 5.0 rating) and no 'Built for Shopify' badge.
◆No known security incidents, CVEs, or data breaches found in public sources.
◆Privacy policy explicitly cites GDPR/BDSG compliance and EU data residency but lacks formal third-party attestations (SOC2/ISO27001).
◆Publisher domain runs behind Imperva CDN with HTTPS, but is missing HSTS and CSP headers.
◆No AI/LLM usage disclosed in privacy policy.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

OAuth scopes not publicly declared on listing

Low

The Shopify app listing page does not explicitly enumerate the OAuth scopes the app requests. Scopes are typically only shown at install time, limiting pre-install transparency.

Evidence

https://apps.shopify.com/callexa-feedback

No HSTS header on publisher domain

Low

The publisher's primary website (callexa.com) does not return a Strict-Transport-Security header, leaving room for SSL-stripping attacks against the marketing/admin surface.

Evidence

https://www.callexa.com/

No Content-Security-Policy header on publisher domain

Low

No CSP header observed in response from callexa.com, reducing browser-side defense in depth against XSS.

Evidence

https://www.callexa.com/

No formal compliance certifications listed

Info

Privacy statement emphasizes GDPR/BDSG compliance but does not reference SOC2, ISO27001, PCI-DSS, or HIPAA certifications.

Evidence

https://www.callexa.com/en/p/nps/privacy-statement

Sub-processor list not comprehensive

Info

Privacy policy references some third parties (Google Analytics, Matomo, support providers) but does not publish a complete sub-processor inventory; a DPA PDF is referenced separately.

Evidence

https://www.callexa.com/en/p/nps/privacy-statement

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	Medium	Likely required to detect shipped orders and trigger post-shipment NPS surveys (inferred from product description; not explicitly declared on listing).
`read_customers`	High	Inferred, needed to email customers for NPS surveys. Exposes PII (email, name); inferred from functionality, not explicitly declared on listing.

read_orders

Medium

Likely required to detect shipped orders and trigger post-shipment NPS surveys (inferred from product description; not explicitly declared on listing).

read_customers

High

Inferred, needed to email customers for NPS surveys. Exposes PII (email, name); inferred from functionality, not explicitly declared on listing.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

callexa.com

EU · Primary app backend and survey delivery (data centers in European Union per privacy policy).

Declared

google-analytics.com

US · Web analytics on marketing site (Google Analytics).

Declared

Sub-processors

Google (Analytics, AdWords)Matomo (self-hosted)Third-party verification providers (unspecified)Third-party support providers (unspecified)

Data residency: EU

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: callexa.com
TLS grade: unknown
HSTS: Missing
CSP: Missing

HTTPS via Imperva CDN. No HSTS or CSP headers observed. Cookies set with Secure+HttpOnly flags.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Strong GDPR/BDSG focus with EU data residency. DPA referenced separately. No formal SOC2/ISO27001/PCI/HIPAA attestations disclosed.

Track record

Publisher reputation

Publisher: OnDemand Web Solutions GmbH
Verified Shopify Partner: No
Years active: 9
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.