Compliance Reports

Review and access Shopify compliance reports

June 26, 2026 - June 26, 2027

PCI Attestation of Compliance (AoC)

This is Shopify's service provider PCI DSS AOC which is the best evidence of the PCI DSS compliance of Shopify's services. It is valid for one year and annually and completed by a Qualified Security Assessor.

View Report

September 9, 2026

PCI External ASV Vulnerability Scan Attestation of Scan Compliance (AoSC)

Shopify's ASV scan attestation for PCI DSS compliance. Shopify completes ASV scans quarterly.

View Report

June 17, 2026

PCI External ASV Vulnerability Scan Attestation of Scan Compliance (AoSC)

Shopify's ASV scan attestation for PCI DSS compliance. Shopify completes ASV scans quarterly.

View Report

April 8, 2026

PCI External ASV Vulnerability Scan Attestation of Scan Compliance (AoSC)

Shopify's ASV scan attestation for PCI DSS compliance. Shopify completes ASV scans quarterly.

View Report

February 18, 2026

PCI External ASV Vulnerability Scan Attestation of Scan Compliance (AoSC)

Shopify's ASV scan attestation for PCI DSS compliance. Shopify completes ASV scans quarterly.

View Report

December 26, 2025

PCI External ASV Vulnerability Scan Attestation of Scan Compliance (AoSC)

Shopify's ASV scan attestation for PCI DSS compliance. Shopify completes ASV scans quarterly.

View Report

April 1, 2025 - March 31, 2026

SOC 3 Report

This report provides assurance over the organization's system and company-level controls governing processes and is based upon the Trust Services Criteria. This report covers the reporting period specified on the cover letter and is publicly accessible.

View Report

October 1, 2024 - September 30, 2025

SOC 3 Report

This report provides assurance over the organization's system and company-level controls governing processes and is based upon the Trust Services Criteria. This report covers the reporting period specified on the cover letter and is publicly accessible.

View Report