View Report

## Shopify. Scan Report - Attestation of Scan Compliance

| A. 1 Scan Customer Information   | A. 1 Scan Customer Information   | A. 2 Approved Scanning Vendor Information   | A. 2 Approved Scanning Vendor Information   |
|----------------------------------|----------------------------------|---------------------------------------------|---------------------------------------------|
| Company: Shopify                 | Company: Shopify                 | Company: MegaplanIT Holdings LLC            | Company: MegaplanIT Holdings LLC            |
| Contact Name: Vicky Lao          | Job Title:                       | Contact Name: Dominick Vitolo               | Job Title: VP of Security Services          |
| Telephone: 1(888) 329-0139       | E-mail: pci@shopify.com          | Telephone: 800-891-1634                     | E-mail: asv@megaplanit.com                  |
| Business Address:                |                                  | Business Address:                           | 18700 N Hayden Rd #340                      |
| Country:                         | City:                            | Country: USA                                | City: Scottsdale                            |
| State/Province:                  | Zip:                             | State/Province: AZ                          | Zip: 85266                                  |
| Website/URL:                     | Website/URL:                     | Website/URL: megaplanit.com                 | Website/URL: megaplanit.com                 |

## A. 3 Scan Status

-  Compliance Status: Passed
-  Scan Report Type: Full Scan
-  Number of unique components scanned: 26
-  Number of active components: 26
-  Number of identified failing vulnerabilities: 0
-  Number of components found by ASV but not scanned because scan customer confirmed components were out of scope:
-  Date scan completed: 09/09/2026
-  Scan expiration date (90 days from date scan completed): 12/09/2026

## A. 4 Scan Customer Attestation

Shopify attests on 09/14/2026 that this scan (either by itself or combined with multiple, partial, or failed scans/rescans, as indicated in the above Section A.3, 'Scan Status') includes all components which should be in scope for PCI DSS, any component considered out of scope for this scan is properly segmented from my cardholder data environment, and any evidence submitted to the ASV to resolve scan exceptions-including compensating controls if applicable-is accurate and complete. Shopify also acknowledges 1) accurate and complete scoping of this external scan is my responsibility, and 2) this scan result only indicates whether or not my scanned systems are compliant with the external vulnerability scan requirement of PCI DSS; this scan result does not represent my overall compliance status with PCI DSS or provide any indication of compliance with other PCI DSS requirements.

## A. 5 ASV Attestation

This scan and report was prepared and conducted by MegaplanIT Holdings LLC, under certificate number 509530-01-03, according to internal processes that meet PCI DSS requirement 11.3.2 and the ASV Program Guide. MegaplanIT Holdings LLC, attests that the PCI DSS scan process was followed, including a manual or automated Quality Assurance process with customer boarding and scoping practices, review of results for anomalies, and review and correction of 1) disputed or incomplete results, 2) false positives, 3) compensating controls (if applicable), and 4) active scan interference. This report and any exceptions were reviewed by Andrew Haslett.