Starship
starship / search / gorgias-helpdesk

Audit report

Gorgias: Helpdesk & Live Chat

Broad accessReach : broadSensitive Access

by Gorgias · Customer Support · Shopify App Store

Built for ShopifyCustomer Supportv6.4.0
Risk level
Broad access
Executive summary

Gorgias est le helpdesk e-commerce le plus populaire sur Shopify. Risque Medium dû au volume de PII traité (tickets contenant emails, addresses, données de commande) et à l'usage croissant d'IA, mitigé par SOC 2 et une gouvernance d'entreprise mature (Insight Partners).

Key insights

  • ◆Helpdesk e-commerce avec macros Shopify natives.
  • ◆Risque Medium, volume important de PII en tickets + IA.
  • ◆Built for Shopify. SOC 2 Type II + GDPR.
  • ◆Éditeur franco-américain (Paris + San Francisco).

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Gorgias est le helpdesk e-commerce le plus populaire sur Shopify. Risque Medium dû au volume de PII traité (tickets contenant emails, addresses, données de commande) et à l'usage croissant d'IA, mitigé par SOC 2 et une gouvernance d'entreprise mature (Insight Partners).

Key insights
  • ◆Helpdesk e-commerce avec macros Shopify natives.
  • ◆Risque Medium, volume important de PII en tickets + IA.
  • ◆Built for Shopify. SOC 2 Type II + GDPR.
  • ◆Éditeur franco-américain (Paris + San Francisco).
  • ◆Plus de 12 000 marchands.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_customers
High

Contexte agent.

read_orders
Medium

Lookup commande dans ticket.

write_customers
Medium

Notes et tags.

read_products
Low

Macros.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
gorgias.com
TLS grade
A+
HSTS
Enabled
CSP
Enabled

TLS 1.3, HSTS preload, CSP.

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Pass
ISO 27001 Fail
PCI DSS Fail

SOC 2 Type II + GDPR + CCPA. DPA publique.

Privacy policy
Track record

Publisher reputation

Publisher
Gorgias
Verified Shopify Partner
Yes
Years active
9
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

LLM providers
OpenAIAnthropic
Data shared with providers

Contenu tickets + contexte commande pour suggestion de réponse.

Retention policy

ZDR avec OpenAI sur Enterprise. Anthropic 30j.