starship / search / shipstation

Audit report

ShipStation

Broad accessReach : broadSensitive Access

by ShipStation · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Broad access

Executive summary

Wherever you sell. However you ship. Exceptionally efficient.

Key insights

◆Built for Shopify badge present; 4.2 rating across 658 reviews indicates mainstream, well-known vendor.
◆Owned by Auctane (parent), with global ShipStation entities; privacy policy hosted at shipstationglobal.com.
◆Uses TLS for all data in transit; corporate site enforces HSTS (max-age=31536000; includeSubDomains) but only a frame-ancestors CSP.
◆Self-certified under EU-U.S. Data Privacy Framework and UK extension; no SOC2/ISO27001/PCI DSS attestations surfaced publicly.

Top findingsview all

High
Broad write access to customers, products, orders, discounts and gift cards

Synthesis

Analysis summary

Wherever you sell. However you ship. Exceptionally efficient.

Key insights

◆Built for Shopify badge present; 4.2 rating across 658 reviews indicates mainstream, well-known vendor.
◆Owned by Auctane (parent), with global ShipStation entities; privacy policy hosted at shipstationglobal.com.
◆Uses TLS for all data in transit; corporate site enforces HSTS (max-age=31536000; includeSubDomains) but only a frame-ancestors CSP.
◆Self-certified under EU-U.S. Data Privacy Framework and UK extension; no SOC2/ISO27001/PCI DSS attestations surfaced publicly.
◆Privacy policy discloses automated decision-making / ML for fraud, personalization, and CX automation, without naming a specific LLM provider.
◆No CVEs or confirmed breach incidents in public CVE databases at audit time; user-reported account takeovers exist but no platform-wide breach.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Broad write access to customers, products, orders, discounts and gift cards

High

App requests edit permissions across customers, products, orders, discounts and gift cards. While shipping/fulfillment requires order write access, the discount and gift card scope is broader than functionally necessary and expands blast radius if the integration is compromised.

Evidence

https://apps.shopify.com/shipstation

No SOC2 / ISO27001 / PCI DSS certification publicly verified

Medium

Third-party risk profile (Rankiteo) and privacy policy do not list SOC2 Type 1/2, ISO27001 or PCI DSS certifications for ShipStation/Auctane. Only EU-U.S. DPF self-certification and GDPR/CCPA alignment are claimed.

Evidence

https://www.rankiteo.com/company/shipstation

Past account-compromise reports involving unauthorized postage purchases

Medium

Public community posts and a LinkedIn user report describe ShipStation accounts being hijacked with unauthorized postage purchases and funds disappearing. ShipStation has since rolled out Adaptive MFA (AMFA), but residual ATO risk on merchant accounts persists.

Evidence

https://community.shipstation.com/t5/Events/Cybersecurity-and-Data-Privacy-Concerns-with-ShipStation/m-p/26217

Automated decision-making / ML used on personal data

Low

Privacy policy discloses use of automated processing and machine learning for fraud detection, personalization, customer-service automation and transaction verification. Third parties are contractually forbidden from training AI models on the data, but the in-house ADMT use is broad.

Evidence

https://www.shipstationglobal.com/legal/privacy-policy/

Phishing campaigns targeting ShipStation users

Low

ShipStation itself publishes guidance about phishing campaigns impersonating the brand to steal merchant credentials. This is a known social-engineering attack surface for merchants installing the app.

Evidence

https://www.shipstation.com/blog/shipstation-phishing-overview/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Reads customer name, email, phone, physical address and geolocation/IP - sensitive PII.
`write_customers`	High	Edit access to customer records broadens blast radius beyond shipping needs.
`read_orders`	High	Required for order fulfillment - reads order line items and shipping data.
`write_orders`	High	Required to mark fulfillment, generate labels, update tracking - core function.
`write_products`	Medium	Edit product data is broader than typically required for a shipping app.
`write_discounts`	Medium	Discount edit access is not strictly required for shipping/fulfillment workflow.
`write_gift_cards`	High	Gift card write access can be monetized by an attacker if the integration is compromised.
`read_shipping`	Low	Required to compute rates and labels - core function.
`write_returns`	Medium	Returns/exchanges category - moderate impact if abused.

read_customers

High

Reads customer name, email, phone, physical address and geolocation/IP - sensitive PII.

write_customers

High

Edit access to customer records broadens blast radius beyond shipping needs.

read_orders

High

Required for order fulfillment - reads order line items and shipping data.

write_orders

High

Required to mark fulfillment, generate labels, update tracking - core function.

write_products

Medium

Edit product data is broader than typically required for a shipping app.

write_discounts

Medium

Discount edit access is not strictly required for shipping/fulfillment workflow.

write_gift_cards

High

Gift card write access can be monetized by an attacker if the integration is compromised.

read_shipping

Low

Required to compute rates and labels - core function.

write_returns

Medium

Returns/exchanges category - moderate impact if abused.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

shipstation.com

US · Primary SaaS / order ingestion / label generation

Declared

auctane.com

US · Parent company corporate / legal

Declared

shipstationglobal.com

US/EU · Global tenant + privacy policy hosting

Declared

Sub-processors

USPS and other postal/delivery carriersPayment processorsGoogle AnalyticsMeta / Microsoft / Google advertising platformsCustomer service providersSecurity/fraud detection vendorsEmail and SMS providersWebsite hosting (WP Engine / Cloudflare)

Data residency: US

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: shipstation.com
TLS grade: A
HSTS: Enabled
CSP: Enabled

HSTS enabled (max-age=31536000; includeSubDomains). CSP limited to frame-ancestors 'self' https://shippingeasy.com - no full directive set. Permissions-Policy and X-Frame-Options SAMEORIGIN set. Fronted by Cloudflare on WP Engine.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Self-certified EU-U.S. DPF + UK extension. GDPR/CCPA aligned. No SOC2/ISO27001/PCI DSS attestations publicly listed per Rankiteo.

Track record

Publisher reputation

Publisher: ShipStation
Verified Shopify Partner: Yes
Years active: 15
Other apps: 0

Past incidents

●Community reports of account takeovers with unauthorized postage purchases
●Active phishing campaigns impersonating ShipStation targeting merchants

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.