ASV Scan Report Attestation of Scan Compliance
A.1 Scan Customer Information
Company:
Shopify
Contact Name:
Manmeet Kaur
Job Title:
Telephone:
(888) 329-0139
E-mail:
manmeet.kaur@shopify.com
Business Address:
City:
State/Province:
ZIP/Postal code:
Country:
Canada
Website/URL:
A.2 Approved Scanning Vendor Information
Company:
ControlCase
Contact Name:
ControlCase ASV Team
Job Title:
Telephone:
+1 703 483 6383
E-mail:
asv@controlcase.com
Business Address:
Fifty West Corporate Center, 3975 Fair Ridge Drive, Suite D - T25s, Fairfax, VA 22033
City:
Fairfax
State/Province:
VA
ZIP/Postal code:
22033
Country:
Website/URL:
www.controlcase.com
A.3 Scan Status
Date scan completed:
December 26, 2025 (GMT)
Scan expiration date (90 days from
date scan completed) :
March 26, 2026 (GMT)
Compliance Status:
Pass
Scan report type:
Full Scan
Partial scan or rescan
Number of unique in-scope components scanned:
25
Number of identified failing vulnerabilities:
0
Number of components found by ASV but not scanned because scan customer confirmed they were out of scope:
0
A.4 Scan Customer Attestation
Shopify attests on December 26, 2025 (GMT) that this scan (either by itself or combined with multiple, partial, or failed scans/rescans, as indicated in the above Section A.3, "Scan status") includes all components which should be in scope for PCI DSS, any component considered out of scope for this scan is properly segmented from my cardholder data environment, and any evidence submitted to the ASV to resolve scan exceptions including compensating controls if applicable is accurate and complete. Shopify also acknowledges 1) accurate and complete scoping of this external scan is my responsibility, and 2) this scan result only indicates whether or not my scanned systems are compliant with the external vulnerability scan requirement of PCI DSS; this scan result does not represent my overall compliance status with PCI DSS or provide any indication of compliance with other PCI DSS requirements.
A.5 ASV Attestation
This scan and report was prepared and conducted by ControlCase under certificate number 4250-01-18, according to internal processes that meet PCI DSS Requirement 11.3.2 and the ASV Program Guide. ControlCase attests that the PCI DSS scan process was followed, including a manual or automated Quality Assurance process with customer boarding and scoping practices, review of results for anomalies, and review and correction of 1) disputed or incomplete results, 2) false positives, 3) compensating controls (if applicable), and 4) active scan interference. This report and any exceptions were reviewed by ControlCase.
ASV Scan Report Summary
| Part 1. Scan Information |
Part 1. Scan Information |
Part 1. Scan Information |
Part 1. Scan Information |
| Scan Customer Company: |
Shopify |
ASV Company: |
ControlCase |
| Date scan was completed: |
December 26, 2025 |
Scan expiration date: |
March 26, 2026 |