Starship
starship / search / embedded-chat

Audit report

Embedded Chat

TrustedReach : broad

by Dev Cloud · Customer support · Shopify App Store

Customer support
Risk level
Trusted
Executive summary

Social Chat Integration For Your Website!

Key insights

  • ◆Live group chat widget that embeds across storefront pages to enable shopper/staff conversations.
  • ◆Publisher Dev Cloud operates from embedded-chat.com; servers hosted in the United States only.
  • ◆Uses OpenAI specifically for content moderation; explicitly states no model training on user data.
  • ◆Sub-processors include Stripe, Shopify billing, OpenAI, Tenor/Google GIF, Google reCAPTCHA.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Social Chat Integration For Your Website!

Key insights
  • ◆Live group chat widget that embeds across storefront pages to enable shopper/staff conversations.
  • ◆Publisher Dev Cloud operates from embedded-chat.com; servers hosted in the United States only.
  • ◆Uses OpenAI specifically for content moderation; explicitly states no model training on user data.
  • ◆Sub-processors include Stripe, Shopify billing, OpenAI, Tenor/Google GIF, Google reCAPTCHA.
  • ◆Marketing/publisher site has clean HTTPS with preload-grade HSTS, X-Frame-Options DENY, no CSP header.
  • ◆No public reviews and no 'Built for Shopify' badge; OAuth scope list not surfaced on the App Store listing page extracted.
  • ◆No CVEs, breaches, or security incidents found tied to Dev Cloud or Embedded Chat in public sources.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

write_script_tags
Medium

L'app ajoute un chat en direct qui s'exécute sur chaque page, ce qui nécessite l'injection de scripts dans la vitrine, induit de la fonction déclarée de l'app.

read_themes
Low

L'affichage d'un composant de chat intégré sur toutes les pages peut impliquer la lecture du thème pour son insertion, induit de la fonction déclarée de l'app.

write_themes
Medium

L'intégration du widget de chat dans les pages de la boutique peut requérir la modification du thème, induit de la fonction déclarée de l'app.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
embedded-chat.com
TLS grade
A
HSTS
Enabled
CSP
Missing

HSTS preload + includeSubDomains, X-Frame-Options DENY, X-Content-Type-Options nosniff, strict-origin-when-cross-origin referrer policy, COOP same-origin. No Content-Security-Policy header observed.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy is published and reasonably detailed (retention, residency, sub-processors). No formal certifications disclosed.

Privacy policy
Track record

Publisher reputation

Publisher
Dev Cloud
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

LLM providers
OpenAI
Data shared with providers

End-user chat messages submitted for moderation only

Retention policy

Per policy, OpenAI does not retain content for training; messages retained for the lifetime of the chat room with auto-clean and manual deletion options. Logs kept ~30 days.