starship / search / shipcloud-connector

Audit report

shipcloud Connector

Broad accessReach : broadSensitive Access

by shipcloud Connector · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Broad access

Executive summary

Print shipping labels directly from your orders

Key insights

◆Publisher shipcloud GmbH is an established German shipping aggregator (founded 2015, Hamburg-based) operating in the EU under GDPR jurisdiction.
◆Privacy policy is thorough and explicit about retention windows and sub-processors, but no SOC2/ISO27001/PCI certifications are claimed publicly.
◆No CVEs or breach reports were found tying shipcloud directly to a security incident.
◆Listing does not carry the 'Built for Shopify' badge.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Print shipping labels directly from your orders

Key insights

◆Publisher shipcloud GmbH is an established German shipping aggregator (founded 2015, Hamburg-based) operating in the EU under GDPR jurisdiction.
◆Privacy policy is thorough and explicit about retention windows and sub-processors, but no SOC2/ISO27001/PCI certifications are claimed publicly.
◆No CVEs or breach reports were found tying shipcloud directly to a security incident.
◆Listing does not carry the 'Built for Shopify' badge.
◆Publisher primary domain redirects shipcloud.io -> shipcloud.com; both serve over HTTPS but lack HSTS and CSP.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

OAuth scopes not publicly declared on listing page

Medium

The Shopify App Store listing does not expose a declared scopes block; scope review must occur at install time. Shipping connectors typically need read/write_orders, read/write_fulfillments, read_customers, and read_shipping.

Evidence

https://apps.shopify.com/shipcloud-connector

No HSTS or Content-Security-Policy on publisher site

Medium

shipcloud.com (publisher primary site, runs WordPress + nginx) responds without Strict-Transport-Security or Content-Security-Policy headers. Reduces transport hardening for the public-facing surface.

Evidence

https://shipcloud.com/

Many third-party trackers on publisher website

Low

Privacy policy enumerates US sub-processors (Heap, Intercom, MailChimp, New Relic, CloudFront) and EU/US ad/analytics platforms (Google, Meta, LinkedIn, Microsoft Advertising). These pertain to the marketing site, not the shipping API, but indicate broad data sharing on the publisher domain.

Evidence

https://shipcloud.com/privacy/

Low merchant rating

Low

Listing rating is 2.3/5 across 9 reviews, suggesting service-quality or integration issues that may correlate with support / operational maturity.

Evidence

https://apps.shopify.com/shipcloud-connector

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	High	Required to generate shipping labels for orders.
`write_orders`	High	Likely needed to update order tags / metadata on fulfillment.
`read_fulfillments`	Medium	Tracking management.
`write_fulfillments`	High	Creating and updating fulfillments / tracking numbers.
`read_customers`	High	Customer name / address required for shipping labels.
`read_shipping`	Medium	Shipping zones and rates.

read_orders

High

Required to generate shipping labels for orders.

write_orders

High

Likely needed to update order tags / metadata on fulfillment.

read_fulfillments

Medium

Tracking management.

write_fulfillments

High

Creating and updating fulfillments / tracking numbers.

read_customers

High

Customer name / address required for shipping labels.

read_shipping

Medium

Shipping zones and rates.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

api.shipcloud.io

EU (Germany) · Shipping label generation, tracking, returns

Declared

shipcloud.com

EU (Germany) · Marketing site

Declared

Sub-processors

Sendinblue GmbHGoogle IrelandMeta Platforms IrelandLinkedIn IrelandMicrosoft IrelandHeap Inc.IntercomMailChimpNew RelicAmazon CloudFrontPayPal Luxembourg

Data residency: EU

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: shipcloud.com
TLS grade: A
HSTS: Missing
CSP: Missing

HTTPS works cleanly with HTTP/2; nginx sets X-Content-Type-Options and X-XSS-Protection but no HSTS, no CSP. shipcloud.io 301-redirects to shipcloud.com.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

German publisher subject to GDPR; privacy notice is detailed with retention periods (server logs 10 days, accounting 10 years, analytics 14 months). No SOC2/ISO27001/PCI certifications are publicly claimed.

Track record

Publisher reputation

Publisher: shipcloud Connector
Verified Shopify Partner: No
Years active: 11
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.