How do agencies typically structure a paid app-stack audit engagement, and what should be in the deliverable?
Short answer
A paid app-stack audit, in Deploi's structure, delivers four artifacts: an app inventory with spend, a script-to-app attribution map, a ranked remove, replace or keep list, and a written install policy. It runs in three phases: inventory, attribution and decision. Shopify's bill omits apps that bill you directly (Shopify Help Center, October 2026), so the inventory needs their invoices.
- Where app charges show
- Settings > Billing, plus separate invoicesSubscription and usage charges sit on the regular Shopify bill, one-time charges on separate invoices, and external charges from apps that bill you directly not at all.Source: Shopify Help Center (App charges on your Shopify bills)
- Billing cycle per app
- An independent 30-day cycle, or 365 days on a yearly planUninstalling a paid app cancels future recurring charges, but the current cycle can still bill, and external charges need cancelling with the developer.Sources: Shopify Help Center (App charges on your Shopify bills, Uninstalling apps); Shopify developer docs (Create time-based subscriptions)
- Shopify's speed summary
- Past 30 days, 75th percentile by defaultReal-user data, kept for 90 days and up to 36 hours late; app installs show as potential changes on the chart.Source: Shopify Help Center (Web performance reports)
- Storefront script tags
- Shopify stops injecting them 1 March 2027No new or updated script tags since 1 October 2026; until March, a tag and its app embed replacement can load the same script twice.Source: Shopify developer docs (Storefront script tags)
Deploi’s call
The install policy is the deliverable. Everything else is evidence for it. An audit without a gate is a snapshot of a stack that will look different in six months, so you will pay for the same work twice.
BuildCommission a paid audit when
- 25 or more apps are installed, the profile Deploi's performance monitoring record scores BUILD (October 2026).
- Field data in Shopify's web performance report fails a good threshold or trends down, and nobody can name the script behind it (Shopify Help Center, October 2026).
- More than one team adds scripts or tags without a developer's review.
- The theme still carries code from apps uninstalled long ago (Shopify Help Center, October 2026).
WaitRun the free checks yourself while
- Fewer than about 10 apps are installed, which the performance monitoring record scores WAIT (October 2026).
- All three Core Web Vitals, Google's page speed metrics, already score good at the 75th percentile (Shopify Help Center, October 2026).
- A theme rebuild is scheduled within two quarters.
Basis: Build or Buy Performance Monitoring & App Audits on Shopify?, our Build vs. Buy decision record, scored BUILD.
How is a paid app-stack audit structured?
A paid app-stack audit runs in three phases, inventory, attribution and decision, and each phase feeds the next. The structure exists because a second of app load time has no published conversion price, so the audit has to find your store's own.
| Phase | What happens | What it produces |
|---|---|---|
| Inventory | Pull app charges from Settings > Billing and vendor invoices, read page source on home, collection and product templates, list tag manager containers, interview owners | What's installed, what's on the page and who asked for it |
| Attribution | Trace each storefront script to its app and its route onto the page, measure it in real-user and lab data, find code left by past uninstalls | The script-to-app map and a shortlist |
| Decision | Rank by recoverable load time against switching cost, price each replacement, write the install gate | The remove, replace or keep list and the install policy |
The order matters because attribution needs the inventory's list of owners, and the policy needs attribution's numbers.
Why can't Shopify's own tools do the audit?
Shopify's own tools can't do the audit, because each one answers only half the question. The bill shows what each app costs, not what it earns; the speed report shows that speed moved, not which app moved it. App subscription and usage charges sit on the regular bill under Settings > Billing, while one-time charges arrive on separate invoices (Shopify Help Center, October 2026). Charges from apps that bill you directly "aren't displayed on your Shopify bill" at all (Shopify Help Center, October 2026). So an audit's spend column is part export, part reconciliation, which the answer on unused app spend walks through.
On speed, Shopify's web performance report summarizes the past 30 days of real-user data at the 75th percentile by default. The data can arrive up to 36 hours late (Shopify Help Center, October 2026). The report marks app installs, theme updates and new code as potential changes. Attribution is the deliverable because the platform stops there.
What should each of the four deliverables contain?
Each deliverable should be complete enough to act on without re-running the audit:
- App inventory with spend. Every app, its monthly charge, usage-fee terms, renewal date, named owner, and whether it touches the storefront. That last column is the one most inventories skip, and the audit turns on it.
- Script-to-app attribution map. Each storefront request traced to the app that caused it, with its route. Routes are an app embed switched on in the theme editor, a script tag, code written into the theme, or a tag manager. Flag every script tag, because none can be created or updated since 1 October 2026 and Shopify stops injecting them on 1 March 2027 (Shopify developer docs, October 2026). Code from apps you already removed gets its own row, or you'll find it again next year.
- Ranked remove, replace or keep list. Ranked by recoverable milliseconds against switching cost, not monthly fee, and checked against the owner-and-cost grid for scripts, which cuts unowned, costly scripts first. Each row carries a migration note, because Shopify warns that "some apps store data that you can't recover after uninstalling" (Shopify Help Center, October 2026).
- Written install policy. A performance budget with a number in it, a named approver and a release step that can stop a release. Deploi's script governance record puts that check in the deploy pipeline itself (October 2026).
What does a weak app-stack audit look like?
A weak app-stack audit is a PDF of Lighthouse screenshots from Google's lab speed test, a list of apps sorted by price and a recommendation to "consolidate". It has no attribution, no migration notes and no policy. It costs less, and its cleanup tends to reverse, because nothing changed about how apps get installed.
The opposite failure is scope creep: a pass that defers images and scripts balloons into a full theme rebuild. Cap the audit, bank the wins, and treat a native-first theme, built on Shopify's own features, as its own decision. Deploi's app-stack record scores that theme BUILD past roughly 30 apps or when script weight is the constraint (October 2026). The record's own profile table scores a $20 million to $100 million store with 30-plus apps CUSTOMIZE. How many apps is too many sets the app-count bands, and the payback of an agency against an in-house audit times the return.
When shouldn't you pay for an app-stack audit?
You shouldn't pay for an app-stack audit when the stack is small, a rebuild is coming or the culprit is already known. Each case needs only some of an audit's deliverables, so your team can produce those itself.
Deploi’s point of view
Our own position, from building on Shopify. Kept apart from the sourced facts above.
- Where we disagree
- Most audit proposals sell the report. We think the report is the cheap part and the attribution is the expensive part, so the attribution is where the budget belongs. Our performance monitoring verdict is BUILD the audit-and-remediation program rather than buy a speed app, because the measurement tools are already free (Deploi verdict, August 2026).
- What we tell clients to expect first
- In our judgment, the inventory finds money before the performance work does: apps nobody owns, apps duplicating a native feature, and usage fees billed on the vendor's own attribution.
- What this page adds
- The parent shows why a second of app bloat has no published price. This page sets out how a paid audit finds a store's own: three phases, four deliverables and what each should contain, the limits of Shopify's bill and speed report, and the two ways an audit fails.
Decision records behind this answer
When this answer changes
- Shopify adds return or category columns to app billing.
- Shopify adds per-app attribution to the web performance report.
- Shopify moves the 1 March 2027 date for storefront script tags.
- Deploi's performance monitoring record changes its WAIT or BUILD bands.
Related questions
This follows from How much does app bloat actually cost a mid-market Shopify store in lost conversion rate per extra second of load time?
- How many apps is 'too many' for a mid-market Shopify store before performance and manageability start to suffer?
Ten apps that load storefront code is the practical performance ceiling for a mid-market Shopify store, because other apps cost no load time.
- What's the realistic ROI timeline for paying an agency to run a full app-stack audit and cleanup vs doing it in-house?
An app-stack audit's savings start within one 30-day billing cycle of each cancelled monthly app, whether an agency or your team runs it (Shopify Help Center, October 2026).
- Is chasing every new 'AI-powered' app feature actually improving our stack, or mostly adding more unproven bloat?
Chasing every new AI-powered app feature mostly adds unproven bloat, not value, because AI-labeled Shopify apps are outrunning the evidence behind them.
- How much does the typical mid-market Shopify store actually overspend per month on apps that are installed but genuinely unused?
Installed-but-unused Shopify app spend has no credible published benchmark, because the figures in circulation estimate total app spend from listed prices, not bills.
- What's the right way to prioritize which third-party scripts to keep versus cut when a performance audit flags too many running simultaneously?
Third-party scripts sort into keep or cut on two axes, measured browser time and a named business owner, so costly scripts with no owner go first.
Sources
Every figure on this page traces to one of these. Official and vendor pages are checked on the date shown; Deploi records are our own published decisions.
- Shopify Help Center, App charges on your Shopify bills
- Shopify Help Center, Web performance reports
- Shopify developer docs, Storefront script tags
- Shopify Help Center, Uninstalling apps
- Shopify developer docs, Create time-based subscriptions
- Deploi Build vs. Buy, Build or Buy Performance Monitoring & App Audits on Shopify?
- Deploi Build vs. Buy, Should You Build or Buy a Shopify App Stack Audit?
- Deploi Build vs. Buy, Build or Buy Third-Party Script Governance on Shopify?