## ASV Scan Report Attestation of Scan Compliance

## A.1 Scan Customer Information

Company:

Shopify

Contact Name:

Manmeet Kaur

Job Title:

Telephone:

(888) 329-0139

E-mail:

pci@shopify.com

Business Address:

City:

State/Province:

Zip/Postal code

Country:

Canada

Website/URL:

## A.2 Approved Scanning Vendor Information

Company:

ControlCase

Contact Name:

ControlCase ASV Team

Job Title:

Telephone:

+1 703 483 6383

E-mail:

asv@controlcase.com

Business Address:

Fifty West Corporate Center, 3975 Fair Ridge Drive, Suite D - T25s, Fairfax, VA 22033

City:

Fairfax

State/Province:

VA

Zip/Postal Code:

22033

Country:

USA

Website/URL:

www.controlcase.com

## A.3 Scan Status

Date Scan Completed:

April 08,2026(GMT)

Scan expiration date

(90 days from date scan completed):

July 07,2026(GMT)

Compliance Status:

Pass

Scan Report Type:

Full Scan

Partial Scan or rescan

Number of unique in-scope components scanned:

25

Number of identified failing vulnerabilities:

0

Number of components found by ASV but not scanned because scan customer confirmed they were out of scope:

0

## A.4 Scan Customer Attestation

Shopify attests on April 08,2026(GMT) that this scan (either by itself or combined with multiple, partial, or failed scans/rescans, as indicated in the above Section A.3, 'Scan Status'), includes all components which should be in scope for PCI DSS, any component considered out of scope for this scan  is properly segmented from my cardholder data environment, and any evidence submitted to the ASV to resolve scan exceptions including compensating controls if applicable is accurate and complete.  Input\_company\_name  also  acknowledges  1)  accurate  and  complete  scoping  of  this  external  scan  is  my responsibility,  and  2)  this  scan  result  only  indicates  whether  or  not  my  scanned  systems  are  compliant  with  the  external vulnerability scan requirement of PCI DSS; this scan result does not represent my overall compliance status with PCI DSS or provide any indication of compliance with other PCI DSS requirements.

## A.5 ASV Attestation

This scan and report was prepared and conducted by ControlCase under certificate number 4250-01-18, according to internal processes that meet PCI DSS Requirement 11.3.2 and the ASV Program Guide. ControlCase attests that the PCI DSS scan process was followed, including a manual or automated Quality Assurance process with customer boarding and scoping practices, review of results for anomalies, and review and correction of 1) disputed or incomplete results, 2) false positives, 3) compensating  controls  (if  applicable),  and  4)  active  scan  interference.  This  report  and  any  exceptions  were  reviewed  by ControlCase.