Shopify Inc.
System and Organization Controls (SOC) 3 Report
Description of Shopify's eCommerce Platform relevant to Security, Availability, and Confidentiality
For the Period April 1, 2025 to March 31, 2026
With Independent Service Auditor's Report
Shopify's eCommerce Platform System
Contents
| SECTION I - Shopify's Management Assertion.....................................................................................1 |
| SECTION II - Independent Service Auditor's Report.............................................................................3 |
| SECTION III - Shopify Inc.'s Description of Its eCommerce Platform Throughout the Period April 1, 2025 to March 31, 2026..........................................................................................................6 |
| ATTACHMENT A - Principal Service Commitments and System Requirements ...................................14 |
SECTION I - Shopify's Management Assertion
T 1.613.241.2828
F 1.855.380.3328
Shopify's Management Assertion
We, as management of, Shopify Inc. are responsible for:
- Identifying the Shopify Inc. eCommerce Platform (System) and describing the boundaries of the System, which are presented in Section III
- Identifying our principal service commitments and system requirements
- Identifying the risks that would threaten the achievement of its principal service commitments and service requirements that are the objectives of our system, which are presented in Attachment A
- Identifying, designing, implementing, operating, and monitoring effective controls over the Shopify Inc. eCommerce Platform (System) to mitigate risks that threaten the achievement of the principal service commitments and system requirements
- Selecting the trust services categories that are the basis of our assertion
Shopify uses subservice organizations for network and infrastructure services. The description indicates that complementary subservice organization controls that are suitably designed and operating effectively are necessary, along with controls at Shopify, to achieve Shopify's service commitments and system requirements based on the applicable trust services criteria. The description presents the types of complementary subservice organization controls assumed in the design of Shopify's controls. The description does not disclose the actual controls at the subservice organizations.
Shopify Inc. performs annual due diligence procedures of the subservice organizations and based on the procedures performed, nothing has been identified that prevents us from achieving its specified service commitments.
In designing the controls over the System we determined that certain requirements of the criteria can be met only if complementary user entity controls are suitably designed and operating effectively for the period April 1, 2025 to March 31, 2026.
We assert that the controls within the system were effective throughout the period April 1, 2025 to March 31, 2026, to provide reasonable assurance that Shopify's service commitments and system requirements were achieved based on the criteria relevant to security, availability, and confidentiality set forth in TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus-2022), in AICPA, Trust Services Criteria.