View Report

## Appendix A: ASV Scan Report Attestation of Scan Compliance

## A.1 Scan Customer Information

Company:

Shopify

Contact Name:

Job Title:

Telephone:

Business Address:

City:

Country:

Manmeet Kaur

(888) 329-0139

Canada

Website/URL:

## A.2 Approved Scanning Vendor Information

Company:

ControlCase

Contact Name:

ControlCase ASV Team

Job Title:

Telephone:

+1 703 483 6383

E-mail:

asv@controlcase.com

Business Address:

Fifty West Corporate Center, 3975 Fair Ridge Drive, Suite D - T25s, Fairfax, VA 22033

City:

Fairfax

State/Province:

VA

ZIP/Postal code:

22033

Country:

Website/URL:

www.controlcase.com

## A.3 Scan Status

Date scan completed:

June 17, 2026 (GMT)

Compliance Status:

Pass

Number of unique in-scope components scanned:

Number of identified failing vulnerabilities:

Number of components found by ASV but not scanned because scan customer confirmed they were out of scope:

September 15, 2026 (GMT)

Full Scan

Partial scan or rescan

21

0

0

A.4 Scan Customer Attestation

Shopify attests on June 17, 2026 (GMT) that this scan (either by itself or combined with multiple, partial, or failed scans/rescans, as indicated in the above Section A.3, "Scan status") includes all components which should be in scope for PCI DSS, any component considered out of scope for this scan is properly segmented from my cardholder data environment, and any evidence submitted to the ASV to resolve scan exceptions including compensating controls if applicable - is accurate and complete. Shopify also acknowledges 1) accurate and complete scoping of this external scan is my responsibility, and 2) this scan result only indicates whether or not my scanned systems are compliant with the external vulnerability scan requirement of PCI DSS; this scan result does not represent my overall compliance status with PCI DSS or provide any indication of compliance with other PCI DSS requirements.

## A.5 ASV Attestation

This scan and report was prepared and conducted by ControlCase under certificate number 4250-01-19, according to internal processes that meet PCI DSS Requirement 11.3.2 and the ASV Program Guide. ControlCase attests that the PCI DSS scan process was followed, including a manual or automated Quality Assurance process with customer boarding and scoping practices, review of results for anomalies, and review and correction of 1) disputed or incomplete results, 2) false positives, 3) compensating controls (if applicable), and 4) active scan interference. This report and any exceptions were reviewed by ControlCase.

Scan expiration date (90 days from date scan completed) :

Scan report type:

E-mail:

State/Province:

manmeet.kaur@shopify.com

ZIP/Postal code: