starship / search / shopify-pos

Audit report

Point of Sale

TrustedReach : broadSensitive Access

by Shopify · Places to sell · Shopify App Store

First-partyPlaces to sell

Risk level

Trusted

Executive summary

Sell anywhere. Accept any payment. Grow your business.

Key insights

◆First-party Shopify app, deeply integrated with the Shopify platform - inherits Shopify's security posture and PCI scope for in-person payments.
◆'Built for Shopify' badge confirms it meets Shopify's highest performance/security/design standards.
◆Privacy handled under Shopify's global privacy policy: data residency split between Canada (Shopify Inc.), Ireland (EEA/UK), and Singapore (APAC).
◆No first-party Shopify breach confirmed; the 2024 incident attributed to a third-party app, not POS.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Sell anywhere. Accept any payment. Grow your business.

Key insights

◆First-party Shopify app, deeply integrated with the Shopify platform - inherits Shopify's security posture and PCI scope for in-person payments.
◆'Built for Shopify' badge confirms it meets Shopify's highest performance/security/design standards.
◆Privacy handled under Shopify's global privacy policy: data residency split between Canada (Shopify Inc.), Ireland (EEA/UK), and Singapore (APAC).
◆No first-party Shopify breach confirmed; the 2024 incident attributed to a third-party app, not POS.
◆Strong network surface on shopify.com: HSTS with preload, HTTPS-only, Cloudflare-fronted.
◆AI usage limited to platform-wide ML and Sidekick assistant; not specific to POS app.

Detections

Findings (3)

Risks detected through static, network, and policy analysis.

First-party Shopify app

Info

Published by Shopify itself - subject to internal security review, SOC 2/ISO/PCI controls of the platform, and 'Built for Shopify' standards.

Evidence

https://apps.shopify.com/shopify-pos

Third-party app breach affecting Shopify merchants (2024)

Low

In July 2024, a threat actor leaked ~180k rows alleged to come from Shopify. Shopify confirmed its own systems were not breached and attributed the leak to a third-party app, not the POS app itself.

Evidence

https://www.malwarebytes.com/blog/news/2024/07/shopify-says-stolen-customer-data-was-taken-in-third-party-breach

Mixed user reviews indicate operational/availability concerns

Medium

App listing shows 2.9/5 rating with frequent complaints about performance, hardware disconnections, and recent UI regressions affecting checkout. Not a direct security finding, but operational instability in a POS payment flow has business-continuity / availability implications.

Evidence

https://apps.shopify.com/shopify-pos

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	Medium	Required to display and process orders in POS.
`write_orders`	High	Required to create/modify orders at checkout.
`read_products`	Low	Required to display catalog at POS.
`write_products`	Medium	Required for inventory adjustments from POS.
`read_customers`	High	Required to look up loyalty/customer profile at POS - includes PII.
`write_customers`	High	Required to create/update customer records from POS.
`read_inventory`	Medium	Required for multi-location inventory visibility.
`write_inventory`	Medium	Required for stock decrement on sale.
`read_locations`	Low	Required for multi-location operations.

read_orders

Medium

Required to display and process orders in POS.

write_orders

High

Required to create/modify orders at checkout.

read_products

Low

Required to display catalog at POS.

write_products

Medium

Required for inventory adjustments from POS.

read_customers

High

Required to look up loyalty/customer profile at POS - includes PII.

write_customers

High

Required to create/update customer records from POS.

read_inventory

Medium

Required for multi-location inventory visibility.

write_inventory

Medium

Required for stock decrement on sale.

read_locations

Low

Required for multi-location operations.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

shopify.com

CA · Core platform / merchant admin / orders

Declared

myshopify.com

global · Storefront / admin API

Declared

cdn.shopify.com

global (Cloudflare) · Static asset delivery

Declared

Sub-processors

Cloud hosting providersCDN providersEmail transmission providersAnalytics providers

Data residency: unknown

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: shopify.com
TLS grade: A
HSTS: Enabled
CSP: Missing

HSTS with includeSubDomains and preload; HTTP/2 + HTTP/3 (alt-svc h3); served via Cloudflare. CSP header not visible on /. X-Content-Type-Options: nosniff present.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Pass

ISO 27001 Pass

PCI DSS Pass

Compliance posture inherited from Shopify platform: Shopify is publicly known to hold PCI DSS Level 1 (required for handling payments at POS), SOC 2, ISO 27001, and supports GDPR processing roles. Privacy policy describes data subject rights consistent with GDPR/CCPA. Specific certs not enumerated in this privacy doc - readers are pointed to shopify.com/security.

Track record

Publisher reputation

Publisher: Shopify
Verified Shopify Partner: Yes
Years active: 20
Other apps: 50

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.