Starship
starship / search / email-collection-bar

Audit report

Email Collection Bar by Hextom

Broad accessReach : broadSensitive Access

by Hextom · Marketing · Shopify App Store

Marketing
Risk level
Broad access
Executive summary

Grow your email list with customizable bar, and boost sales

Key insights

  • ◆Built for Shopify badge present, 4.6 rating with ~80 reviews surfaced on listing.
  • ◆Publisher Hextom is a well-known multi-app Shopify vendor with a long catalog of merchandising apps.
  • ◆App's core function is email capture with sync to MailChimp/Klaviyo, implying customer PII (email addresses) leaves the Shopify boundary.
  • ◆Data hosted on US-based servers per privacy policy; site fronted by AWS CloudFront/S3.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Grow your email list with customizable bar, and boost sales

Key insights
  • ◆Built for Shopify badge present, 4.6 rating with ~80 reviews surfaced on listing.
  • ◆Publisher Hextom is a well-known multi-app Shopify vendor with a long catalog of merchandising apps.
  • ◆App's core function is email capture with sync to MailChimp/Klaviyo, implying customer PII (email addresses) leaves the Shopify boundary.
  • ◆Data hosted on US-based servers per privacy policy; site fronted by AWS CloudFront/S3.
  • ◆GDPR mentioned in policy; no SOC2/ISO27001/PCI/HIPAA certifications claimed.
  • ◆No public CVE, breach, or named security incident tied to Hextom or this specific app was found.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_customers
High

Likely required to associate captured emails with existing Shopify customer records (not formally declared on listing; inferred from app functionality).

write_script_tags
Medium

Bars/popups typically inject storefront JS via script tags or theme app extensions (inferred from functionality).

read_themes
Low

Needed to render the bar in storefront theme context (inferred).

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
hextom.com
TLS grade
A
HSTS
Missing
CSP
Missing

Served via AWS CloudFront in front of S3; clean HTTPS, but no HSTS or CSP headers observed.

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

GDPR addressed in privacy policy. CCPA, SOC2, ISO27001, PCI DSS, HIPAA not mentioned. Retention window unspecified.

Privacy policy
Track record

Publisher reputation

Publisher
Hextom
Verified Shopify Partner
Yes
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.