Shopify is a service we recommend to ecommerce businesses that prioritize security. It provides a dedicated environment for protecting card data, restrictions that help prevent checkout tampering, and ongoing platform updates and monitoring. Individual stores do not have to build these protections from scratch. Shopify's continued responsibility for this work after launch is a major reason to choose it on security grounds.
This makes a practical difference for stores where the same people manage products, promotions, and orders, with no one dedicated to server maintenance or overnight monitoring. Merchants can leave platform maintenance to Shopify while managing the people who access the admin, the apps they install, and the customer information they use in their work.
To understand why you can choose Shopify with confidence, look beyond certification badges. Consider how functions that handle card numbers are separated, who controls the code allowed into checkout, and who fixes problems once they are found. The explanation below is based on materials available in October 2026 and focuses on stores using Shopify's Online Store and Shopify Checkout.
Security work continues after launch
An ecommerce site's security cannot be maintained through its initial configuration alone. Newly discovered software weaknesses need to be fixed, and added features need to be checked for other problems. When an alert signals something unusual, someone must investigate and act before the damage spreads.
If your company or agency maintains your ecommerce software, the ongoing work includes tracking updates, deciding which versions to apply, testing, and preparing to roll back if something goes wrong. A maintenance contract that covers only design changes leaves these tasks to be arranged separately. Even a secure configuration at launch can fall behind on newly discovered weaknesses if no one is responsible for updates.
Shopify handles fixes and updates to the platform it manages. Merchants do not need to find platform update files and apply them to their own servers. Protection for checkout and the environment that handles card data is part of that platform.
| Ongoing work | A setup maintained by your company or a contractor | A setup using Shopify's standard platform |
|---|---|---|
| Updating ecommerce software | Track fixes, apply them to your store, and test the results | Shopify updates the platform, removing the need for each store to maintain its own platform update process |
| Protecting the environment that handles card data | Choose a payment method and manage where data passes through your implementation and where it is stored | Use Shopify's payment features to sell without storing full card numbers in the systems used for your store's day-to-day work |
| Managing checkout code | Keep track of added code and maintain updates and protections against unauthorized changes | Shopify manages checkout itself and the scope in which extension code can run |
| Monitoring the platform and responding to emergencies | Arrange monitoring, assign someone to receive alerts, and establish investigation and remediation procedures | Shopify monitors and responds to platform issues; the merchant checks the impact on their store and handles customer communication |
A setup you maintain yourself can also remain secure when properly entrusted to a specialist company. When comparing options, consider more than the monthly fee: establish who performs updates and whose contract covers incidents on holidays. This makes the staffing and support you need clearer. One advantage of Shopify is that this platform operation is included in the service.
Keeping card data separate from everyday store operations
Customers enter their names, shipping addresses, and card details in a single checkout. Your fulfillment team needs the shipping address, but it does not need to read the full card number to send a parcel. Shopify separates the handling of information according to these different uses.
In regular order management, merchants process orders using order details and payment status. Even features that save payment information for later charges, such as subscriptions, do not provide a way for merchants to retrieve the full card details after entry. You can continue selling without storing card numbers in customer lists or fulfillment systems.
Separate card fields from the surrounding page
In Shopify's published card-processing architecture, customers enter card details in an iframe provided by Shopify. An iframe embeds a separate document within a page. Separating the card fields from the surrounding page allows the entered values to be processed without simply passing them to the page as a whole.
If a store collects card numbers through its own regular form and sends them to a payment provider through its server, that server also becomes part of the environment that needs to protect card data. Shopify's input features remove the need for the merchant to build a form and server-side process that receive card numbers. This design avoids adding sensitive information beyond what the store needs for its work.
Separate collection from decryption
The processing beyond the card fields is also split into distinct functions. The process that receives card data encrypts it and stores it temporarily, then passes an identifier to the next process so that it can retrieve the data. A separate process handles decryption, which makes the information readable again, and transmission to the payment provider.
This separation means that access to encrypted data used in the handoff does not carry the same permission as the ability to read card numbers. Even if someone obtained only the encrypted temporary data, they could not read the card numbers directly without access to the decryption function. Access paths are separated, and each process receives only the capabilities it needs.
The temporary data used in the handoff is deleted after use or within one hour. This prevents information needed during payment processing from being retained indefinitely. That deadline is separate from the retention period for stored cards as a whole.
Store card data in a dedicated environment
Shopify has a dedicated environment for storing and processing card data, separate from its general systems. The listed stored fields are the card number, expiry date, and cardholder name. The security code entered during payment is not included among these stored fields.
Isolated input fields, an encrypted handoff, separate decryption, and storage in a dedicated environment work together to restrict the paths to card data. Merchants can accept payments without building the storage servers, access controls, or processes that delete temporary handoff data themselves.
The flow described here is based on Shopify's PCI DSS Attestation of Compliance covering services such as Shopify Payments and Shop Pay Wallet. If you add an external payment service, also check the input interface it provides and how it handles information.
Manage order information and data sent to other services
Keeping card data separate from regular operations does not remove the need for names, addresses, contact details, and order histories in fulfillment and customer support. People with the necessary permissions use this information in the Shopify admin. If you install an email marketing or logistics app, the information you authorize may also be passed to that service.
The dedicated card-data environment and the customer information used in everyday store operations serve different people and functions. Information passed to a CSV file or an external app also needs to be managed where it is stored. The diagram labels are in Japanese.
For example, allowing an email marketing app to use customer information does not give it unrestricted access to dedicated card storage. The names and email addresses sent for marketing, however, still need protection within that app. Understanding this distinction helps you decide exactly which information your store manages while relying on Shopify for payment protection.
Why Shopify restricts code added to checkout
Isolating card fields alone is not enough if the surrounding page can be freely modified. Malicious code in that page could replace the genuine card fields with fake ones, leading customers to enter their information into the imitation.
Shopify also manages the checkout surrounding the card fields. When a merchant or app adds a feature, Shopify does not give that code permission to directly control the entire checkout page. Restricting where added features can run prevents each new feature from adding another party with the ability to rewrite card fields.
Limit the permissions given to extensions
Checkout UI extensions, which can add elements such as messages to checkout, run in an isolated environment called a sandbox. Shopify's technical documentation describes the use of iframes and Web Workers to separate custom code from checkout itself. A Web Worker runs code separately from the code that can directly manipulate the page.
Checkout UI extensions use components supplied by Shopify and APIs that provide access to permitted information and operations. Extensions cannot directly access sensitive payment information, such as card details, or the HTML of checkout itself. They also add their interface through a communication channel managed by Shopify.
For example, a feature that displays a message at checkout needs a component for showing that message. It does not need permission to read the contents of card fields or rewrite the whole checkout page. This structure matches the permissions given to a feature with the interface it needs to provide.
The card-entry iframe separates entered values from the surrounding page, while the extension sandbox limits what added code can do. Both work alongside Shopify's management of checkout itself. The diagram labels are in Japanese.
Manage the code running in checkout itself
Alongside isolated extensions, the code running in checkout itself also needs protection. Shopify states that it reviews and updates the code it uses, maintains an inventory of loaded scripts, and manages changes.
These controls include Content Security Policy, or CSP, which restricts the execution of unauthorized scripts, and Subresource Integrity, or SRI, which checks whether a loaded file matches its expected contents. CSP can also report violations, combining execution restrictions with visibility into suspicious activity.
If a merchant builds its own checkout, it must maintain not only card-entry functionality but also an inventory of surrounding code, updates, and protections against tampering. Shopify takes on that work for Shopify Checkout. There are limits on freely adding code, but those limits enable Shopify to manage protection across the checkout as a whole.
When customizing checkout, work with your agency to determine whether supported extensions can provide the interface and actions you need. UI extensions on the information, shipping, and payment steps require Shopify Plus. The protections for checkout itself, however, are not limited to stores that install UI extensions.
Ongoing updates, access control, and monitoring
A secure architecture becomes less effective if software weaknesses are left unresolved or operations staff have more access than they need. Shopify continues to update its platform, control internal access, review changes, and monitor and respond to unusual activity as part of operating the service.
Investigate weaknesses and apply fixes
Shopify performs vulnerability assessments and penetration tests, investigates the issues it finds, and tracks the necessary fixes. A vulnerability is a weakness in software or configuration that could be used in an attack. Penetration testing uses methods based on real attacks to look for places where defenses can be defeated.
Shopify continually applies platform fixes and security updates. Because individual stores do not have to make and implement platform update decisions, they are less likely to face a delay in which a fix is available but no one has been assigned to apply it. Shopify's management also includes reviewing and updating external code used in checkout.
Its process also accounts for updates that might cause other problems. In addition to testing before production release, Shopify manages change review, approval, rollout, and rollback when something goes wrong. Applying a fix and checking whether that change causes problems with sales or information handling are treated as connected tasks.
Control access from within Shopify
Employees who work on the platform are also subject to authentication and access restrictions. The public SOC 3 report describes employee multifactor authentication, production access limited to what is needed, periodic access reviews, and removal of access when employees leave.
Multifactor authentication helps prevent unauthorized entry when only a password has been compromised. Limiting permissions reduces the information and functions an attacker can use if an employee's account is compromised. Reviewing access when people change roles or leave also prevents permissions needed for a previous job from remaining in place.
Both the technology that separates the card environment and the operational controls governing who can enter it are necessary. Shopify manages access on the service operator's side as well as authentication for the admin used by merchants.
Have people assess alerts and follow issues through to resolution
Shopify publishes information about its use of centralized, correlated system logs to generate automated alerts. Around-the-clock on-call staff evaluate those alerts, initiate response procedures for significant incidents, and track them through to resolution.
An alert alone does not move a response forward if no one investigates it. People who assess what happened, together with procedures for mitigation, investigation, and response, connect detection to the work that follows. Stores using Shopify's platform do not have to create this on-call coverage or these internal platform investigation procedures from scratch.
Using Shopify therefore includes ongoing work to investigate platform weaknesses, apply fixes, and respond to unusual activity, alongside a place to list products. The ability to start selling with that operation in place, even without dedicated technical staff, is a strength of Shopify.
Independent assessments and external vulnerability reports
Shopify's protections can be assessed through external review mechanisms as well as the provider's own explanations. PCI DSS evaluates the card-data environment, SOC assesses controls over a specified period, and the bug bounty program accepts reports from external researchers. Each serves a different purpose.
PCI DSS assessment of card-data protection
PCI DSS is a security standard for environments that store, process, or transmit card data. Shopify publishes its Level 1 compliance and undergoes annual assessments by a qualified assessor and quarterly external vulnerability scans. Level 1 is an assessment category, not a ranking of services from most to least secure.
For merchants, the value is access to the controls and assessments of a card-data environment through Shopify's payment platform. This reduces the scope of the card storage environment you must design, protect, and keep assessed yourself. Shopify's public materials also describe the architecture from entry to storage, so you can show your internal procurement reviewers what the assessment covers, alongside the certification name.
SOC assessment of controls over time
SOC 3 includes an independent auditor's opinion on whether controls relating to the security and other aspects of the covered services operated effectively over a specified period. The publicly available report covers April 2025 through March 2026.
The value lies in an outside party assessing controls over time, beyond a policy statement about access restrictions or monitoring. People selecting a service for their company can review materials with a defined scope and period and compare them with the security controls their organization requires. The report is available through Shopify's official report listing.
Accept vulnerability reports from external researchers
Alongside periodic assessments, Shopify runs a bug bounty program. It gives external researchers a channel to report weaknesses such as unauthorized access to personal information, permission flaws, and privilege escalation. Defined scope and reporting procedures allow issues found outside the service to feed into investigation and remediation.
Shopify continues to pay rewards to external researchers who report issues. As of October 18, 2026, its official bug bounty page lists the following amounts actually paid.
| Period | Bounties paid |
|---|---|
| All-time total | Approximately US$10.2 million |
| 2026 | Approximately US$1.59 million |
For critical vulnerabilities, Shopify sets rewards of up to US$200,000 depending on impact. After receiving a report, it reproduces and validates the issue, assesses the impact, and determines the reward. Developers then fix the problem, and retesting checks whether it has been resolved.
This is an ongoing process that connects findings by external specialists with fixes and retesting. In addition to periodic assessments, a program that supports researcher participation through bounties is another reason to choose Shopify.
Other managed ecommerce services also offer PCI DSS compliance and platform maintenance. When choosing a service, compare how much of your operation its standard features can support, as well as whether it meets your store's security requirements. Stores whose requirements fit Shopify's standard features can use the protections and operations described here without expanding the parts they must maintain themselves.
Authentication, permissions, and data management remain ongoing store responsibilities
While using the platform's protections, merchants manage who can enter the admin and which information is sent elsewhere. Information legitimately accessible for fulfillment or customer support can be taken if an account is compromised or permissions remain with someone who no longer needs them.
Protect sign-in and prepare recovery options
The owner and each staff member should use their own accounts. Ending the practice of sharing the owner's password lets you assign permissions to each person and remove only that person's access when they leave.
Open Security from your personal profile and set up a passkey on a compatible device. Passkeys let you sign in with methods such as facial or fingerprint recognition instead of a password. Start from Passkeys, then check the same section after creation to confirm that the passkey is registered and where it is saved. Prepare a backup passkey or another authentication method in case you lose the device. See Shopify's passkey setup instructions.
Passkeys and two-step authentication are separate settings in Shopify. Also enable two-step authentication in the same personal account's security settings, and store recovery codes somewhere secure that you can access even if you lose your authentication device. Enable two-step authentication for your sign-in email account too, and check for suspicious forwarding rules. Email is used for account recovery and important notifications.
For staff settings, a person with the necessary permissions can open Settings → Users → the relevant user and review the option for requiring a secure sign-in method. Enabling the requirement signs the affected user out, so coordinate it with a break in their work. Plus also offers an option to enforce the requirement for all users. Labels and the scope of available settings vary with admin updates and the plan.
Give people only the permissions their work requires
In Settings → Users, review staff roles and the actions each person is allowed to perform. A support representative may need to view customer information without needing permission to export all customers to a CSV file. Viewing and exporting customer information can be considered separately.
For someone assisting with fulfillment, choose permissions based on the order actions needed to ship items. Decide separately whether their work also includes installing apps or editing the theme. Change permissions when people move roles and remove access that is no longer needed when they leave. These are examples of defining roles; agree on the actual operations needed with each person.
Give your agency access as a collaborator, checking the identity of the requester and the requested permissions before approving them. Remove the existing access when the work or maintenance arrangement ends. Changing the collaborator request code alone does not remove access that has already been approved.
Know where apps and CSV files store information
In Settings → Apps → the relevant app, you can review the areas it can access, its read and edit permissions, and the personal data it handles. For an email marketing app, compare the access with its purpose: does it need only email addresses, or do the features you will use also require addresses or order histories? Check the provider's guidance and privacy policy for storage locations and deletion terms after cancellation. If those are unclear, ask before installing.
Before disconnecting and removing unused apps, check with the person responsible whether they are still needed for seasonal work or another purpose. Also ask the provider or your agency about deleting customer information stored externally and removing added code left in the theme.
When exporting a CSV file, decide who can access the copy and how long it will be kept. For example, a working CSV used to import email recipients could contain only the necessary fields, be stored where only the people doing the work can open it, and be deleted after the import results are confirmed. Separately define the retention period and deletion owner for data kept in an external customer management system. This does not mean deleting all records indiscriminately, including records that must be retained by law or evidence needed for an incident investigation.
Assign maintenance responsibility for custom components
Custom forms, external customer management systems, and headless setups that build a storefront separately from a standard theme also require maintenance of their servers, sign-in processes, stored data, and external CMS. Assign responsibility separately for Shopify's platform updates and for updates to the features your company adds. Keep the domain management account and renewal notifications accessible to the store as well.
You can use a request like this when asking your agency to review the setup.
Please list which customer information our custom forms and external integrations send, where they send it, and where it is stored. Include the person responsible for updating each system and the contact for incidents. Please also check whether custom app permissions are limited to what is necessary, whether secret tokens are exposed in customers' browsers or logs, and whether they can be revoked and reissued if leaked. Do not include the secret values themselves in the report.
If Shopify notifies you of a data breach
Prepare for an incident by deciding where you will verify a notification and who will coordinate the response. For a breach caused by an issue on Shopify's side, Shopify handles investigation and remediation within the platform, while the merchant establishes the impact on its own customers and makes the necessary communications.
Investigating the impact, preventing further harm, and managing reporting deadlines should proceed in parallel where needed. Other responses should not wait until the full investigation is complete. The diagram labels are in Japanese.
Verify the impact through official channels
Rather than immediately signing in through a link in the notification email, open your usual admin or official support channel yourself. Confirm that the notification is genuine and that your store is affected. Record when it arrived, the affected store, and the case reference, and assign an internal contact.
When contacting the provider, ask for the information needed to decide your response. The following is an example request.
Please confirm whether our store is affected, the affected period, the data fields involved, the number of people affected, and the extent of access or removal that has been confirmed. Please address payment information, such as card numbers, separately from names, addresses, and order histories.
We would also like to know whether the risk is ongoing and whether there are any processes we should stop or credentials we should change. Please explain which notifications and response actions your company will handle, what our store needs to do, and when you expect to provide the next update.
Keep the notification, available logs, configuration change history, and records of who did what and when. Deleting suspicious files or logs in bulk can remove evidence needed to determine the cause. Restrict access to the place where these records are stored.
Stop the routes through which harm is continuing
If unauthorized access is ongoing, work with the provider or developers to suspend affected integrations, remove account access, and revoke leaked credentials. Make decisions about preserving evidence and containing further harm in parallel, so that a dangerous access route is not left open until every detail is known.
If you suspect that your own store account has been compromised, tell Shopify Support and review authentication for Shopify and the sign-in email account, suspicious logins, and configuration changes. If the problem is within the platform, ask Shopify to remediate it and take the necessary store-side measures based on the notification you receive. Decide what to suspend according to the affected information and the risk that remains ongoing.
Proceed with reporting and customer notification
Under Japan's Act on the Protection of Personal Information, certain data breaches and other incidents, or suspected incidents, require reporting to the Personal Information Protection Commission (PPC) or another relevant authority and notification to affected individuals. There are four categories: incidents involving special care-required personal information; a risk of financial harm; a risk that the incident resulted from an act committed for a wrongful purpose; or more than 1,000 affected individuals. A breach caused by unauthorized access may therefore be reportable even when few people are affected.
| Action | Timing |
|---|---|
| Preliminary report to the PPC or other relevant authority | Promptly after becoming aware of a reportable incident, generally within about 3–5 days, using the information known at that point |
| Final report to the PPC or other relevant authority | In principle, within 30 days, counting the day of awareness as day 1; within 60 days for the category involving a risk that the incident resulted from an act committed for a wrongful purpose |
| Notification to affected customers | Promptly according to the circumstances, communicating information relevant to the individual as the investigation progresses |
The reporting clock does not wait for Shopify's final report. For a corporation, the reference point is when any department becomes aware of the reportable incident. Assess encryption, outsourcing relationships, the appropriate reporting authority, and cases where notifying individuals is difficult with your legal team or a specialist, based on the circumstances and the PPC's guidelines.
Even when the notification comes from a provider, establish whether the merchant or the provider will make the regulatory report and notify individuals. Under specified conditions, an entrusted processor may notify the organization that entrusted it with the data, and that organization handles the response. Customer notices should cover the affected information, the known cause and impact, precautions against further harm, and a contact point. Distinguish confirmed facts from matters still under investigation.
Who to contact when card information is involved
If card information has been breached or a breach is suspected, promptly contact your payment provider or merchant acquirer. Confirm the investigation required, the scope of any payment suspension, and the guidance to give customers. Make these contacts under your payment agreements separately from reporting to public authorities.
Advice about card replacement and similar measures should reflect the information involved and the payment provider's assessment. Do not tell customers that card numbers were also exposed when only a breach of names and addresses has been confirmed.
Define the work your store will continue to manage
Shopify combines the separation of card-handling functions and checkout protection with updates, monitoring, remediation, and external assessments. Because stores do not have to build and continually maintain those platform operations individually, we recommend Shopify as an option for a new store or migration where security is a priority.
When deciding to adopt it, separate the sales requirements Shopify's standard features can meet from those that need custom development. Then list the people who can access the admin, the apps receiving customer information and where they store it, the people responsible for maintaining custom components, and the contacts for incidents. Sharing this list with your agency also helps establish who will continue doing which work after launch.
If your store is already operating, start by reviewing owner and staff authentication, unnecessary permissions, unused apps, and CSV files whose storage locations are unclear. Using the platform protections Shopify maintains while making the management of your people and data part of everyday work is a practical way to operate with confidence.
