## Shopify Inc. System and Organization Controls (SOC) 3 Report Description of Shopify's eCommerce Platform relevant to Security, Availability, and Confidentiality For the Period October 1, 2024 to September 30, 2025 With Independent Service Auditor's Report ## Shopify's eCommerce Platform System ## Contents | SECTION I - Shopify's Management Assertion.....................................................................................1 | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | SECTION II - Independent Service Auditor's Report.............................................................................3 | | SECTION III - Shopify Inc.'s Description of Its eCommerce Platform Throughout the Period October 1, 2024 to September 30, 2025..............................................................................................6 | | ATTACHMENT A - Principal Service Commitments and System Requirements ...................................14 | ## SECTION I - Shopify's Management Assertion T 1.613.241.2828 F 1.855.380.3328 ## Shopify's Management Assertion We, as management of, Shopify Inc. are responsible for: -  Identifying the Shopify Inc. eCommerce Platform (System) and describing the boundaries of the System, which are presented in Section III -  Identifying our principal service commitments and system requirements -  Identifying the risks that would threaten the achievement of its principal service commitments and service requirements that are the objectives of our system, which are presented in Attachment A -  Identifying, designing, implementing, operating, and monitoring effective controls over the Shopify Inc. eCommerce Platform (System) to mitigate risks that threaten the achievement of the principal service commitments and system requirements -  Selecting the trust services categories that are the basis of our assertion Shopify uses subservice organizations for network and infrastructure services. The description indicates that complementary subservice organization controls that are suitably designed and operating effectively are necessary, along with controls at Shopify, to achieve Shopify's service commitments and system requirements based on the applicable trust services criteria. The description presents the types of complementary subservice organization controls assumed in the design of Shopify's controls. The description does not disclose the actual controls at the subservice organizations. Shopify Inc. performs annual due diligence procedures of the subservice organizations and based on the procedures performed, nothing has been identified that prevents us from achieving its specified service commitments. In designing the controls over the System we determined that certain requirements of the criteria can be met only if complementary user entity controls are suitably designed and operating effectively for the period October 1, 2024 to September 30, 2025. We assert that the controls within the system were effective throughout the period October 1, 2024 to September 30, 2025, to provide reasonable assurance that Shopify's service commitments and system requirements were achieved based on the criteria relevant to security, availability, and confidentiality set forth in TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus-2022), in AICPA, Trust Services Criteria. Shopify Inc. ## SECTION II - Independent Service Auditor's Report 3 ## Independent Service Auditor's Report To: Shopify Inc. ('Shopify') ## Scope We have examined Shopify's accompanying assertion titled 'Shopify's Management Assertion' (assertion) that the controls within Shopify's eCommerce Platform (system) were effective throughout the period October 1, 2024 to September 30, 2025, to provide reasonable assurance that Shopify's service commitments and system requirements were achieved based on the trust services criteria relevant to security, availability, and confidentiality (applicable trust services criteria) set forth in TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus-2022) , in AICPA, Trust Services Criteria . The description of the boundaries of the system indicates that complementary user entity controls that are suitably designed and operating effectively are necessary, along with controls at Shopify, to achieve Shopify's service commitments and system requirements based on the applicable trust services criteria. The description of the boundaries of the system presents the complementary user entity controls assumed in the design of Shopify's controls. Our examination did not include such complementary user entity controls and we have not evaluated the suitability of the design or operating effectiveness of such controls. Shopify uses subservice organizations to provide network and infrastructure services. The description of the boundaries of the system indicates that complementary subservice organization controls that are suitably designed and operating effectively are necessary, along with controls at Shopify, to achieve Shopify's service commitments and system requirements based on the applicable trust services criteria. The description of the boundaries of the system presents the types of complementary subservice organization controls assumed in the design of Shopify's controls. Our examination did not include the services provided by the subservice organizations, and we have not evaluated the suitability of the design or operating effectiveness of such complementary subservice organization controls. ## Service organization's responsibilities Shopify is responsible for its service commitments and system requirements and for designing, implementing, and operating effective controls within the system to provide reasonable assurance that Shopify's service commitments and system requirements were achieved. Shopify has also provided the accompanying assertion about the effectiveness of controls within the system. When preparing its assertion, Shopify is responsible for selecting, and identifying in its assertion, the applicable trust service criteria and for having a reasonable basis for its assertion by performing an assessment of the effectiveness of the controls within the system. ## Service auditor's responsibilities Our responsibility is to express an opinion, based on our examination, on management's assertion that controls within the system were effective throughout the period to provide reasonable assurance that the service organization's service commitments and system requirements were achieved based on the applicable trust services criteria. Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. Those standards require that we plan and perform our examination to obtain reasonable assurance about whether management's assertion is fairly stated, in all material respects. We believe that the evidence we obtained is sufficient and appropriate to provide a reasonable basis for our opinion. We are required to be independent and to meet our other ethical responsibilities in accordance with relevant ethical requirements relating to the engagement. ## Our examination included: -  Obtaining an understanding of the system and the service organization's service commitments and system requirements. -  Assessing the risks that controls were not effective to achieve Shopify's service commitments and system requirements based on the applicable trust services criteria. -  Performing procedures to obtain evidence about whether controls within the system were effective to achieve Shopify's service commitments and system requirements based on the applicable trust services criteria. Our examination also included performing such other procedures as we considered necessary in the circumstances. ## Inherent limitations There are inherent limitations in the effectiveness of any system of internal control, including the possibility of human error and the circumvention of controls. Because of their nature, controls may not always operate effectively to provide reasonable assurance that the service organization's service commitments and system requirements were achieved based on the applicable trust services criteria. Also, the projection to the future of any conclusions about the effectiveness of controls is subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate. ## Opinion In our opinion, management's assertion that the controls within Shopify's eCommerce Platform were effective throughout the period October 1, 2024 to September 30, 2025, to provide reasonable assurance that Shopify's service commitments and system requirements were achieved based on the applicable trust services criteria if complementary subservice organization controls and complementary user entity controls assumed in the design of Shopify's controls operated effectively throughout that period is fairly stated, in all material respects. Louisville, Colorado November 19, 2025 ## SECTION III Shopify Inc.'s Description of Its eCommerce Platform throughout the Period October 1, 2024 to September 30, 2025 ## Shopify's SOC 3 Service Description ## 1 Shopify overview Shopify is a leading global commerce company, providing trusted tools to start, grow, market, and manage retail businesses of any size. Shopify provides an eCommerce platform and services that are engineered for reliability, while delivering a better shopping experience for consumers everywhere. Shopify's core software-as-a-service (SaaS) offering is a cloud-hosted online storefront, a cloud-hosted checkout process, and a back-end administration portal for merchants to manage customers, products, orders, and other standard business operations, as well as application programming interfaces (APIs) to support these processes. ## 2 Scope The SOC 3 scope includes the components required for Shopify merchants to do the following: - Create a store - Have products in the store - Have buyers (that is, merchant customers) be able to add products into a cart, perform a checkout, and receive their product ## 2.1 Scope inclusions The scope of this report includes the systems required to provide the following functionality: ## For all merchants: | Component | Functionality | |--------------|---------------------------------------------------------------------------------------------------------------| | Accounts | Manage staff accounts and permissions. | | Admin access | Connect to the Shopify admin using secure transmission. | | Analytics | Access analytics and reports from the Shopify admin. | | B2B | Sell to business customers. | | Buyers | View, modify, or delete buyer records. | | Buyer access | Merchant customers can connect to the online store using secure transmission. | | Checkout | Allow buyers to complete checkout using Shopify Payments, if it's enabled for the store. | | Gift cards | Configure gift cards as a product or use them as a payment method. | | Markets | Manage global sales from a single store. | | Orders | View or modify details of completed orders, including fulfillment status, and related financial transactions. | | Component | Functionality | |------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Products | Configure product descriptions, prices, discounts, taxes, shipping rates, and inventory. | | Shipping | Select a shipping method. | | Shop Pay | Enable buyers to check out using Shopify's accelerated checkout functionality. | | Shopify Payments | Accept payment using the primary payment gateways associated with Shopify Payments, use exchange rates from Shopify Payments, view financial transactions with Shopify Payments, and manage chargebacks. | | Shopping cart | Enable buyers to add one or more products to a shopping cart. | | Store | Create an online store that can display web pages to buyers and potential buyers. | | Support | Contact 24/7 merchant support for assistance. | | Taxes | Calculate taxes using Shopify Tax, Basic Tax, and Manual Tax services. Automated tax filing and Value-Added Tax (VAT) invoicing using Shopify Tax. | ## For all merchants (opt-in applications): | Component | Functionality | |--------------------------------------|---------------------------------------------------------------------------------------| | Flow | Automate tasks and business processes. | | Point of Sale | Sell products in person with Shopify POS, iOS, and Android applications. | | Shop App | Enable mobile shopping experience for buyers. | | Store management mobile applications | Connect to the Shopify Admin using the Shopify mobile application for iOS or Android. | ## For Shopify Plus merchants (opt-in applications): | Component | Functionality | |------------------------------|--------------------------------------------------------------------------------| | Avalara AvaTax App Connector | Connect a Shopify Plus store to an Avalara AvaTax account. | | Launchpad | Monitor events like sales campaigns, product releases, and content changes. | | Script Editor | Create personalized checkout experiences and promotions using Shopify Scripts. | | Tax Partners | Connect to supported tax partners configured in the Shopify admin. | ## 2.2 Scope exclusions The scope of this report excludes systems not noted in the Scope inclusion section. ## 3 System components ## 3.1 Infrastructure Shopify data processing and storage primarily takes place in North America. For some merchants whose business address is in Europe, data is at rest in Europe by default. Shopify uses a network as a service for edge routing and cloud service providers for storefronts and other services. ## 3.2 Routing An incoming web request for a site hosted on Shopify travels over an encrypted Transmission Control Protocol (TCP) connection to the network as a service. Information is encrypted in transit using Transport Layer Security (TLS) wherever it passes over the Internet. ## 3.3 Software The Shopify platform is a multi-tenant, cloud-based system that is engineered for high scalability, reliability, and performance. Shopify's software consists of applications, backed by databases, that provide Shopify's eCommerce platform services. The core application makes APIs and dashboards available to store owners and staff, which allows them to manage the configuration and business operations of their store in accordance with the features listed in the Scope section. ## 3.4 Data ## 3.4.1 Collection Shopify collects data from Shopify merchants and merchants' customers to provide its services. Merchant and customer data is encrypted at rest and in transit wherever it passes over the Internet. Additional information on data collection and usage is noted in Shopify's Privacy Policy. ## 3.4.2 Retention Shopify classifies and retains information in accordance with its Privacy policies. ## 4 Control environment ## 4.1 Organizational structure Shopify maintains an organizational structure with clear lines of responsibility. Shopify's executive team sets the strategic direction for the company and works closely with the senior leadership team to establish objectives that will allow Shopify to meet its mission: Make commerce better for everyone . The senior leadership team communicates these objectives and translates them into measurable outputs. The Chief Information Security Officer (CISO) is responsible for setting the security direction for the company and leading the Shopify Trust team. The Trust team's mission is to protect the trust that merchants have placed in Shopify. ## 4.1.1 Hiring Role descriptions are published in job postings on the Shopify careers page, where candidates can apply for positions. Potential candidates are evaluated on their ability to meet the position requirements. Shopify further screens candidates by conducting reference checks before hiring. Contractors who work for an outsourced vendor are screened in accordance with the contract Shopify holds with the vendor. Employees who join as part of an acquisition, Shopify performs due diligence on the company in preparation for the acquisition. ## 4.1.2 Board of Directors Shopify has a Board of Directors that represents shareholders. The responsibilities and composition of the Board of Directors are outlined in charters that are regularly reviewed by Board of Directors members and published on Shopify's website. ## 4.2 Risk assessment Shopify has defined a risk management process drawn from a mix of standards and industry best practices that finds, ranks, and responds to potential risks to the security of the service. The security leadership team is regularly updated on security findings, risk decisions, and actions taken. These results are elevated to senior management as deemed necessary by the CISO. ## 4.2.1 Security assessment Shopify security assessments generate findings that feed into the risk management process. Other operational activities may also generate relevant security findings. These findings, along with output from the security assessment, are evaluated using the risk management process. ## 4.2.2 Fraud risk assessment Shopify conducts a regular fraud risk assessment that identifies and evaluates fraud threats to the company. ## 4.2.3 Leadership assessment Shopify leadership regularly assess adherence to policies, operational irregularities such as availability or security incidents, and regulatory and litigation matters. ## 4.3 Policies and procedures Shopify maintains a security policy that is reviewed regularly and approved by the CISO. Upon hire, Shopify employees review and acknowledge Shopify policies. Employees review and agree to the Code of Conduct regularly. Shopify maintains incident response plans, access management procedures, and procedures for reviewing the security of third-party software and services. ## 4.4 Incident management Shopify's public website instructs merchants on how to report concerns. If needed, the Shopify Support team is also available 24/7 to assist merchants with questions or issues. If a serious issue is found, then the incident response process is activated. Events and incidents are tracked through to resolution. When the situation warrants it, Shopify updates the public status page. ## 4.5 Service monitoring Shopify continuously monitors the platform through automated logs and alerts. Shopify forwards logs to a centralized logging service for aggregation, correlation, and alerting. Logs are retained according to defined retention schedules. The logging and monitoring services are configured to generate alerts. The alerts page an on-call team member who evaluates the alert. Relevant team members are on call 24/7. ## 4.6 Logical access control ## 4.6.1 Merchant access When a merchant creates their Shopify store online, their store owner account is also created. Store owners can provision staff accounts that can be configured with granular access to the store. For Shopify Plus merchants, a Shopify Plus team member works with the merchant to complete the signup process, which creates both their store and staff owner account. Store owners can provision staff accounts for their organization or individual stores. The store owner's account and staff accounts are terminated when a merchant closes their store. Merchants may also terminate staff accounts individually through the Shopify admin. ## 4.6.2 Shopify employee access Access is granted to new employees according to a documented procedure. MFA is enforced during onboarding. Access to Shopify's code version control system is integrated into Shopify's access management systems. ## 4.6.2.1 Elevated access Shopify restricts employee access to the production environment and internal applications that manage production access, according to the principle of least privilege. Shopify conducts regular reviews of employee access to the production environment and internal applications that manage production access. ## 4.6.2.2 Account termination Shopify removes employee access promptly following termination. ## 4.7 Change management Shopify's application and infrastructure change management process follows the principles of test driven development (TDD) and continuous integration (CI), using a remote version control system. Shopify defines procedures for reviewing, approving, deploying, and reverting changes which include best practices for coding and security. ## 4.8 Availability Shopify monitors capacity, defines resources as required, and conducts capacity and disaster readiness activities on a regular basis. Shopify also maintains its availability through geographical redundancy and frequent backups. ## 5 Information and communication ## 5.1 External communication Shopify uses established communication channels to provide updates to merchants about changes that may impact the service. Merchants are able to review Shopify's Terms of Service, Acceptable Use Policy, and Privacy Policy on the website. If merchants require additional assistance, Shopify maintains a 24/7 customer support Help Center. ## 5.2 Internal communication Shopify conducts security training for new employees to reinforce the commitments outlined in the security policy. The training course is maintained by the Trust team. Shopify's commitments to the security, availability, and confidentiality of the system are also posted on an internal site. Shopify communicates timely updates to Shopify employees about security, availability, and confidentiality topics, as required. ## 5.3 Whistleblower program Shopify's anonymous whistleblower program is available internally and externally, and communicated through the Shopify Code of Conduct, and the Shopify Investor Relations website. Any communications to the whistleblower program are directed to Shopify's General Counsel and the Chair of the Audit Committee. ## 5.4 Reporting incidents Incidents are handled as they occur by appropriate individuals, depending on the severity, or potential severity, of the incident. Material incidents are disclosed to Executives and the Board of Directors. ## 6 Subservice organizations Shopify uses third parties to support the operation of its services. Shopify's eCommerce platform controls should be evaluated taking into account Complementary Subservice Organization Controls expected to be implemented by the subservice organizations. ## 6.1 Subservice organization review To manage the services provided by these third parties, Shopify's Trust team conducts security reviews of the subservice organizations and material vendors regularly. Reviewers evaluate attestation reports or inquire about relevant security controls with the vendor. ## 7 Complementary user entity controls The Shopify eCommerce platform controls were designed with the assumption that certain controls would be implemented by user entities (or 'merchants'). Merchants may be required to implement additional technical or administrative controls to meet their business and legal needs. ## Attachment A ## Principal Service Commitments and System Requirements A ## Shopify's principal service commitments and system requirements Shopify designs its processes and procedures to meet its objectives for the Shopify eCommerce Platform. Those objectives are based on the service commitments that Shopify makes to user entities (or merchants), the laws and regulations that govern the provision of the platform, and the financial, operational, and compliance requirements that Shopify has established. The Shopify eCommerce Platform is subject to relevant regulations, as well as State privacy security laws and regulations in the jurisdictions in which Shopify operates. Security, availability and confidentiality commitments to user entities are documented and communicated in customer agreements, as well as in the description of the service offering provided on the Shopify website. Security, availability, and confidentiality commitments are standardized and include, but are not limited to, the following: - Security principles inherent to the fundamental design of the Shopify eCommerce Platform are intended to permit users to access the information and resources they need based on their role in the system while restricting them from accessing information not needed for their role. - Availability principles inherent to the fundamental design of the Shopify eCommerce Platform are designed to provide fault tolerance and sufficient resources to ensure the availability of the Shopify eCommerce Platform. - Confidentiality principles inherent to the fundamental design of the Shopify eCommerce Platform are designed to identify and protect data from receipt to disposal. Shopify establishes operational requirements that support the achievement of security, availability and confidentiality commitments, relevant laws and regulations, and other system requirements. Such requirements are communicated in Shopify's policies and procedures, system design documentation, and contracts with customers. Information security policies define an organization-wide approach to how systems and data are protected. These include policies around how the service is designed and developed, how the system is operated, how the internal business systems and networks are managed, and how employees are hired and trained. The Shopify eCommerce Platform is designed based on a shared responsibility model where both Shopify and the user entities are responsible for aspects of security, availability, and confidentiality. Details of the responsibilities of user entities can be found on the Shopify website and in the customer contract.