Starship
starship / search / calltrackingmetrics

Audit report

CallTrackingMetrics

Broad accessReach : broadSensitive Access

by Call Tracking Metrics LLC · Customer support · Shopify App Store

Customer support
Risk level
Broad access
Executive summary

Call Tracking & Automation Platform for Merchants

Key insights

  • ◆CallTrackingMetrics (CTM) is an established call tracking / conversation intelligence vendor; Shopify is a minor secondary channel for them.
  • ◆Publisher holds SOC 2 Type 2 attestation and supports GDPR rights, meaningful security posture for a US-only vendor.
  • ◆Core capability requires storefront script injection (DNI) plus SMS automation tied to orders, moderate but not exceptional data-access footprint.
  • ◆All customer data stored in US; no EU residency option disclosed.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Call Tracking & Automation Platform for Merchants

Key insights
  • ◆CallTrackingMetrics (CTM) is an established call tracking / conversation intelligence vendor; Shopify is a minor secondary channel for them.
  • ◆Publisher holds SOC 2 Type 2 attestation and supports GDPR rights, meaningful security posture for a US-only vendor.
  • ◆Core capability requires storefront script injection (DNI) plus SMS automation tied to orders, moderate but not exceptional data-access footprint.
  • ◆All customer data stored in US; no EU residency option disclosed.
  • ◆No known CVEs or public breach incidents found for CallTrackingMetrics.
  • ◆Zero reviews after ~8.5 years on the App Store suggests Shopify integration is rarely installed and lightly maintained.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_orders
Medium

Required to surface caller order history and trigger fulfillment-related SMS notifications; reasonable for stated functionality.

read_customers
High

Needed to identify callers and tie SMS/voice campaigns to buyer preferences; exposes PII (name, email, phone).

write_script_tags
High

Inferred, Dynamic Number Insertion typically requires injecting JavaScript on the storefront; storefront script injection is a high-impact scope.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
calltrackingmetrics.com
TLS grade
unknown
HSTS
Enabled
CSP
Enabled

Apex domain 301-redirects to ctm.com. Target serves HSTS (max-age=31622400; includeSubDomains; preload), a frame-ancestors CSP, and X-Frame-Options SAMEORIGIN. Hosted on Pantheon / nginx with Varnish.

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Pass
ISO 27001 Fail
PCI DSS Fail

SOC 2 Type 2 attestation publicly claimed by publisher. GDPR rights and DPO referenced in policy. ISO 27001, PCI DSS, and HIPAA not mentioned. Third-party penetration testing claimed.

Privacy policy
Track record

Publisher reputation

Publisher
Call Tracking Metrics LLC
Verified Shopify Partner
No
Years active
14
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

LLM providers
Data shared with providers

Customer behavioral and interaction data used in AI/ML models for product/service recommendations and research initiatives per privacy policy.

Retention policy

Retained as long as reasonably necessary for collection purposes; extended for legal/regulatory needs; some data kept in de-identified/aggregated form.