## Payment Card Industry Data Security Standard
## Attestation of Compliance for Report on Compliance - Service Providers
Version 4.0.1
Publication Date: August 2024
## PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance - Service Providers
Entity Name: Shopify Inc.
Date of Report as noted in the Report on Compliance: 26 June 2026
Date Assessment Ended: 26 May 2026
## Section 1: Assessment Information
## Instructions for Submission
This Attestation of Compliance (AOC) must be completed as a declaration of the results of the service provider's assessment against the Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures (' Assessment'). Complete all sections. The service provider is responsible for ensuring that each section is completed by the relevant parties, as applicable. Contact the entity(ies) to which this AOC will be submitted for reporting and submission procedures.
This AOC reflects the results documented in an associated Report on Compliance (ROC). Associated ROC sections are noted in each AOC Part/Section below.
Capitalized terms used but not otherwise defined in this document have the meanings set forth in the PCI DSS Report on Compliance Template.
## Part 1. Contact Information
| Part 1a. Assessed Entity (ROC Section 1.1) | Part 1a. Assessed Entity (ROC Section 1.1) |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Company name: | Shopify Inc. |
| DBA (doing business as): | Shopify Shopify International Limited Shopify Commerce Singapore Pte. Ltd Shopify Payments (USA) Inc. Shopify Payment Activities, Inc. Shopify Payments EU Limited Shopify Payments UK Limited |
| Company mailing address: | 151 O'Connor Street, Ground Floor, Ottawa, ON, K2P 2L8, Canada |
| Company main website: | www.shopify.com |
| Company contact name: | Andrew Dunbar |
| Company contact title: | Chief Information Security Officer |
| Contact phone number: | 855.816.3857 |
| Contact e-mail address: | pci@shopify.com |
| Part 1b. Assessor (ROC Section 1.1) | Part 1b. Assessor (ROC Section 1.1) |
| Provide the following information for all assessors involved in the Assessment. If there was no assessor for a given assessor type, enter Not Applicable. | Provide the following information for all assessors involved in the Assessment. If there was no assessor for a given assessor type, enter Not Applicable. |
| PCI SSC Internal Security Assessor(s) | PCI SSC Internal Security Assessor(s) |
| ISA name(s): | Not Applicable |
| Qualified Security Assessor | Qualified Security Assessor |
| Company name: | Coalfire Systems |
| Company mailing address: | 330 N. Wabash, Suite 1430 Chicago, IL 60611 |
| Company website: | https://www.coalfire.com |
| Lead Assessor name: | Ron White |
Assessor phone number:
+1 (877) 224-8077
Assessor e-mail address:
CoalfireSubmission@coalfire.com
Assessor certificate number:
204-164
## Part 2. Executive Summary
Part 2a. Scope Verification
Services that were INCLUDED in the scope of the Assessment (select all that apply):
Name of service(s) assessed:
Shopify Payments
Shopify eCommerce Stores
Shopify Subscriptions Vaulting Service
Shop Pay Wallet
External Marketplace Integration
Type of service(s) assessed:
Hosting Provider:
Applications / software
Hardware
Infrastructure / Network
Physical space (co-location)
Storage
Web-hosting services
Security services
3-D Secure Hosting Provider
Multi-Tenant Service Provider
Other Hosting (specify):
Not Applicable
Managed Services:
Systems security services
IT support
Physical security
Terminal Management System
Other services (specify):
Not Applicable
Payment Processing:
POI / card present
Internet / e-commerce
MOTO / Call Center
ATM
Other processing (specify):
Not Applicable
Account Management
Fraud and Chargeback
Payment Gateway/Switch
Back-Office Services
Issuer Processing
Prepaid Services
Billing Management
Loyalty Programs
Records Management
Clearing and Settlement
Merchant Services
Tax/Government Payments
Network Provider
Others (specify): Vault and Card Expiry Update
Note: These categories are provided for assistance only and are not intended to limit or predetermine an entity's service description. If these categories do not apply to the assessed service, complete 'Others.' If it is not clear whether a category could apply to the assessed service, consult with the entity(ies) to which this AOC will be submitted.
## Part 2. Executive Summary (continued)
Part 2a. Scope Verification (continued)
Services that are provided by the service provider but were NOT INCLUDED in the scope of the Assessment (select all that apply):
Name of service(s) not assessed:
Not Applicable
Type of service(s) not assessed:
Hosting Provider:
Applications / software
Hardware
Infrastructure / Network
Physical space (co-location)
Storage
Web-hosting services
Security services
3-D Secure Hosting Provider
Multi-Tenant Service Provider
Other Hosting (specify):
Not Applicable
Managed Services:
Systems security services
IT support
Physical security
Terminal Management System
Other services (specify):
Not Applicable
Payment Processing:
POI / card present
Internet / e-commerce
MOTO / Call Center
ATM
Other processing (specify):
Not Applicable
Account Management
Fraud and Chargeback
Payment Gateway/Switch
Back-Office Services
Issuer Processing
Prepaid Services
Billing Management
Loyalty Programs
Records Management
Clearing and Settlement
Merchant Services
Tax/Government Payments
Network Provider
Others (specify): Not Applicable
Provide a brief explanation why any checked services were not included in the Assessment:
Not Applicable
## Part 2b. Description of Role with Payment Cards (ROC Sections 2.1 and 3.1)
Describe how the business stores, processes, and/or transmits account data.
Shopify unifies all online commerce onto a single platform. With Shopify, merchants can build and customize an online store and sell in multiple places, including web, mobile, in person, brick-and-mortar locations, and pop-up shops across multiple channels from social media to online marketplaces. Shopify offers to its merchants and other customers the possibility of selling goods and services on its e- commerce sites via credit cards and other payment methods. End-customers pay for these services via real-time web-browser entry of credit card information
| | (iFrame), through a stored credit card, or in person via Shopify POS. Shopify receives encrypted cardholder data via dedicated ecommerce lines from Merchant sites and POS devices. POS devices are provided and managed by the third-party service provider (TPSP) Stripe, who were found to be compliant against PCI DSS v.4.0.1 controls with an AOC dated March 1, 2026. In addition, Shopify receives payments via e-commerce for their services provided to Merchants. |
|------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Describe how the business is otherwise involved in or has the ability to impact the security of its customers' account data. | Not Applicable. Please see above and below for CHD flows. |
| Describe system components that could impact the security of account data. | The processing components are applications and databases that directly hold, process, and protect CHD which are managed by Shopify personnel utilizing the in-scope applications and database, which include the following: Hosted Fields: Secure implementation via JavaScript SDK to configure the iFrame served by Shopify for secure payment card information input from customers during the Shopify checkout process. Cardsink: Accepts payment card information and makes it accessible to Cardserver through its Memcached instance. It separates all client-facing payment card operations from Cardserver by encrypting data using a public key pair (CBC AES- 256) then generating and returning a session ID to index the encrypted data in Memcached. Memcached: Temporary in-memory cache for Cardsink to securely exchange CHD with Cardserver. The contents of Memcached are encrypted and deleted once used or within the hour. Data in Memcached expires every hour and data is overwritten by incoming transactions or deleted via Cardserver. Cardserver: Passes payment transactions to the payment gateway by retrieving the encrypted data in Memcached via the defined session ID. Cardserver then uses Shopify's private key to decrypt the data and send the PAN, CVV, expiry and name to the payment provider for authorization. PAN, expiry date and name are the only data items retained on the relevant database. Database: Used by Cardserver, stores PAN, expiry date and name data items. Wharf / CCIE (Credit-card Importer / Exporter): Standalone app that imports/exports Credit Cards. Outbound connection from the CDE is to payment gateways, credit card import/export recipients and Shopify partners for marketplace integrations. |
## Part 2. Executive Summary (continued)
## Part 2c. Description of Payment Card Environment
Provide a high-level description of the environment covered by this Assessment.
For example:
- Connections into and out of the cardholder data environment (CDE).
- Critical system components within the CDE, such as POI devices, databases, web servers, etc., and any other necessary payment components, as applicable.
Shopify stores, processes, and transmits cardholder data exclusively in a dedicated CDE (Cardholder Data Environment) that transmits the data to payments gateways for payment processing. Shopify's CDE consists of three environments (clusters) in two GCP regions: Iowa and South Carolina. Each environment consists of processing and ingress components. The processing components are applications and databases that directly hold, process, and protect CHD which are managed by Shopify personnel utilizing the in-scope applications and database, which include the following:
- System components that could impact the security of account data.
- Hosted Fields
- Cardsink
- Memcached
- Cardserver
- Databases
- Wharf / CCIE (Credit-card Importer / Exporter)
Indicate whether the environment includes segmentation to reduce the scope of the Assessment.
(Refer to the 'Segmentation' section of PCI DSS for guidance on segmentation)
Yes
No
## Part 2d. In-Scope Locations/Facilities (ROC Section 4.6)
List all types of physical locations/facilities (for example, corporate offices, data centers, call centers and mail rooms) in scope for this Assessment.
| Facility Type | Total Number of Locations ( How many locations of this type are in scope) | Location(s) of Facility (city, country) |
|-----------------|-----------------------------------------------------------------------------|-------------------------------------------|
| GCP Datacenter | 2 | Iowa, USA South Carolina, USA |
## Part 2. Executive Summary (continued)
Part 2e. PCI SSC Validated Products and Solutions (ROC Section 3.3)
Does the entity use any item identified on any PCI SSC Lists of Validated Products and Solutions 0F ?
Yes
No
Provide the following information regarding each item the entity uses from PCI SSC's Lists of Validated Products and Solutions:
| Name of PCI SSC validated Product or Solution | Version of Product or Solution | PCI SSC Standard to which Product or Solution Was Validated | PCI SSC Listing Reference Number | Expiry Date of Listing |
|-------------------------------------------------|----------------------------------|---------------------------------------------------------------|------------------------------------|--------------------------|
| Not Applicable | Not Applicable | Not Applicable | Not Applicable | Not Applicable |
* For purposes of this document, 'Lists of Validated Products and Solutions' means the lists of validated products, solutions, and/or components, appearing on the PCI SSC website (www.pcisecuritystandards.org) (for example, 3DS Software Development Kits, Approved PTS Devices, Validated Payment Software, Point to Point Encryption (P2PE) solutions, Software-Based PIN Entry on COTS (SPoC) solutions, Contactless Payments on COTS (CPoC) solutions), and Mobile Payments on COTS (MPoC) products.
## Part 2. Executive Summary (continued)
## Part 2f. Third-Party Service Providers
( ROC Section 4.4 )
For the services being validated, does the entity have relationships with one or more third-party service providers that:
- Store, process, or transmit account data on the entity's behalf (for example, payment gateways, payment processors, payment service providers (PSPs, and off-site storage))
Yes
No
- Manage system components included in the entity's Assessment (for example, via network security control services, anti-malware services, security incident and event management (SIEM), contact and call centers, web-hosting companies, and IaaS, PaaS, SaaS, and FaaS cloud providers)
Yes
No
- Could impact the security of the entity's CDE (for example, vendors providing support via remote access, and/or bespoke software developers).
Yes
No
If Yes:
Name of Service Provider:
Description of Services Provided:
PayPal, Inc. (Braintree Payment Processing System, eCommerce & MOTO)
Payment Processor
Google LLC
Google Cloud Platform Services
Okta, Inc. (Customer Identity Cloud, Identity as a Service)
Identity Management
Stripe, Inc.
Payment Processor
Note: Requirement 12.8 applies to all entities in this list.
## Part 2. Executive Summary (continued)
## Part 2g. Summary of Assessment (ROC Section 1.8.1)
Indicate below all responses provided within each principal PCI DSS requirement.
For all requirements identified as either 'Not Applicable' or 'Not Tested,' complete the 'Justification for Approach' table below.
Note: One table to be completed for each service covered by this AOC. Additional copies of this section are available on the PCI SSC website.
## Name of Service Assessed:
Shopify Payments Shopify eCommerce Stores Shopify Subscriptions Vaulting Service Shop Pay Wallet
External Marketplace Integration
| PCI DSS Requirement | Requirement Finding More than one response may be selected for a given requirement. Indicate all responses that apply. | Requirement Finding More than one response may be selected for a given requirement. Indicate all responses that apply. | Requirement Finding More than one response may be selected for a given requirement. Indicate all responses that apply. | Requirement Finding More than one response may be selected for a given requirement. Indicate all responses that apply. | Select If a Compensating Control(s) Was Used |
|-----------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|
| PCI DSS Requirement | In Place | Not Applicable | Not Tested | Not in Place | Select If a Compensating Control(s) Was Used |
| Requirement 1: | | | | | |
| Requirement 2: | | | | | |
| Requirement 3: | | | | | |
| Requirement 4: | | | | | |
| Requirement 5: | | | | | |
| Requirement 6: | | | | | |
| Requirement 7: | | | | | |
| Requirement 8: | | | | | |
| Requirement 9: | | | | | |
| Requirement 10: | | | | | |
| Requirement 11: | | | | | |
| Requirement 12: | | | | | |
| Appendix A1: | | | | | |
| Appendix A2: | | | | | |
For any Not Applicable responses, identify which sub- requirements were not applicable and the reason.
1.3.3, 2.3.1, 2.3.2, 4.2.1.2 - No wireless is used within the environment
2.2.5 - No insecure protocols or services in use 3.3.2, 3.3.3 - No SAD is stored within the
environment
3.5.1.1 - Hashes are not used for PAN 3.5.1.2, 3.5.1.3 - Disk Level encryption is not
leveraged
3.7.9 - Shopify does not share encryption keys
4.2.2 - Shopify does not send PAN via messaging technologies
5.3.2.1 - Active scanning is used instead of periodic
5.3.3 - No removable electronic media used
6.4.1 - Superseded by Requirement 6.4.2
6.5.2 - No significant changes
8.2.2 - Group, shared, or generic IDs are not used within the environment
8.2.3 - Shopify does not have access to their customer premises
8.2.7 - No third-party access to the environment 8.3.9, 8.3.10.1 - the environment is not accessible using a single factor
8.3.10 - Superseded by Requirement 8.3.10.1 8.6.1, 8.6.2 - System accounts are not interactive accounts
9.4.6 - No electronic media is used for the environment
9.5.1, 9.5.1.1, 9.5.1.2, 9.5.1.2.1, 9.5.1.3 - POI devices are not used within the environment 10.7.1 - Superseded by Requirement 10.7.2. 11.3.2.1, 12.5.3 - No significant changes for the
environment
11.4.7 - Shopify is not a multi-tenant service provider 12.3.2 - No customized approaches used
A1 - Shopify is not a Multi-Tenant Service Provider
A2 - POI devices are not used within the environment
For any Not Tested responses, identify which sub- requirements were not tested and the reason.
Not Applicable
## Section 2 Report on Compliance
## ( ROC Sections 1.2 and 1.3 )
Date Assessment began:
Note: This is the first date that evidence was gathered, or observations were made.
2026-02-23
Date Assessment ended:
Note: This is the last date that evidence was gathered, or observations were made.
2026-05-26
Were any requirements in the ROC unable to be met due to a legal constraint?
Yes
No
Were any testing activities performed remotely?
Yes
No
## Section 3 Validation and Attestation Details
## Part 3. PCI DSS Validation (ROC Section 1.7)
This AOC is based on results noted in the ROC dated (Date of Report as noted in the ROC 2026-06-27) . Indicate below whether a full or partial PCI DSS assessment was completed:
Full Assessment - All requirements have been assessed and therefore no requirements were marked as Not Tested in the ROC.
Partial Assessment - One or more requirements have not been assessed and were therefore marked as Not Tested in the ROC. Any requirement not assessed is noted as Not Tested in Part 2g above.
Based on the results documented in the ROC noted above, each signatory identified in any of Parts 3b-3d, as applicable, assert(s) the following compliance status for the entity identified in Part 2 of this document (select one) :
Compliant: All sections of the PCI DSS ROC are complete, and all assessed requirements are marked as being either In Place or Not Applicable, resulting in an overall COMPLIANT
rating; thereby Shopify Inc. has demonstrated compliance with all PCI DSS requirements except those noted as Not Tested above.
Non-Compliant: Not all sections of the PCI DSS ROC are complete, or one or more requirements are marked as Not in Place, resulting in an overall NON-COMPLIANT rating; thereby Shopify Inc. has not demonstrated compliance with PCI DSS requirements.
Target Date for Compliance: Not applicable
An entity submitting this form with a Non-Compliant status may be required to complete the Action Plan in Part 4 of this document. Confirm with the entity to which this AOC will be submitted before completing Part 4.
- Compliant but with Legal exception: One or more assessed requirements in the ROC are marked as Not in Place due to a legal restriction that prevents the requirement from being met and all other assessed requirements are marked as being either In Place or Not Applicable, resulting in an overall COMPLIANT BUT WITH LEGAL EXCEPTION rating; thereby Not applicable has demonstrated compliance with all PCI DSS requirements except those noted as Not Tested above or as Not in Place due to a legal restriction.
This option requires additional review from the entity to which this AOC will be submitted.
If selected, complete the following:
Affected Requirement
Details of how legal constraint prevents requirement from being met
Not Applicable
Not Applicable
## Part 3. PCI DSS Validation (continued)
## Part 3a. Service Provider Acknowledgement
## Signatory(s) confirms:
(Select all that apply)
The ROC was completed according to PCI DSS , Version 4.0.1 and was completed according to the instructions therein.
All information within the above-referenced ROC and in this attestation fairly represents the results of the Assessment in all material respects.
PCI DSS controls will be maintained at all times, as applicable to the entity's environment.
## Part 3b. Service Provider Attestation
Signature of Service Provider Executive Officer
Date:
Service Provider Executive Officer Name: Andrew Dunbar
Title: CISO
## Part 3c. Qualified Security Assessor (QSA) Acknowledgement
If a QSA was involved or assisted with this Assessment, indicate the role performed:
QSA performed testing procedures.
QSA provided other assistance.
If selected, describe all role(s) performed:
Signature of Lead QSA
Date:
Lead QSA Name: Ron White
Signature of Duly Authorized Officer of QSA Company
Date:
Duly Authorized Officer Name: Brad Shifflett
QSA Company: Coalfire
## Part 3d. PCI SSC Internal Security Assessor (ISA) Involvement
If an ISA(s) was involved or assisted with this Assessment, indicate the role performed:
ISA(s) performed testing procedures.
ISA(s) provided other assistance.
If selected, describe all role(s) performed: Not applicable
<unknown>
<unknown>
<unknown>
## Part 4. Action Plan for Non-Compliant Requirements
Only complete Part 4 upon request of the entity to which this AOC will be submitted, and only if the Assessment has Non-Compliant results noted in Section 3.
If asked to complete this section, select the appropriate response for 'Compliant to PCI DSS Requirements' for each requirement below. For any 'No' responses, include the date the entity expects to be compliant with the requirement and provide a brief description of the actions being taken to meet the requirement.
| PCI DSS Requirement | Description of Requirement | Compliant to PCI DSS Requirements (Select One) | Compliant to PCI DSS Requirements (Select One) | Remediation Date and Actions (If 'NO' selected for any Requirement) |
|-----------------------|-----------------------------------------------------------------------------------------------------------------|--------------------------------------------------|--------------------------------------------------|-----------------------------------------------------------------------|
| PCI DSS Requirement | Description of Requirement | YES | NO | Remediation Date and Actions (If 'NO' selected for any Requirement) |
| 1 | Install and maintain network security controls | | | Not applicable. |
| 2 | Apply secure configurations to all system components | | | Not applicable. |
| 3 | Protect stored account data | | | Not applicable. |
| 4 | Protect cardholder data with strong cryptography during transmission over open, public networks | | | Not applicable. |
| 5 | Protect all systems and networks from malicious software | | | Not applicable. |
| 6 | Develop and maintain secure systems and software | | | Not applicable. |
| 7 | Restrict access to system components and cardholder data by business need to know | | | Not applicable. |
| 8 | Identify users and authenticate access to system components | | | Not applicable. |
| 9 | Restrict physical access to cardholder data | | | Not applicable. |
| 10 | Log and monitor all access to system components and cardholder data | | | Not applicable. |
| 11 | Test security systems and networks regularly | | | Not applicable. |
| 12 | Support information security with organizational policies and programs | | | Not applicable. |
| Appendix A1 | Additional PCI DSS Requirements for Multi- Tenant Service Providers | | | Not applicable. |
| Appendix A2 | Additional PCI DSS Requirements for Entities using SSL/early TLS for Card- Present POS POI Terminal Connections | | | Not applicable. |
Note: The PCI Security Standards Council is a global standards body that provides resources for payment security professionals developed collaboratively with our stakeholder community. Our materials are accepted in numerous compliance programs worldwide. Please check with your individual compliance accepting organization to ensure that this form is acceptable in their program. For more information about PCI SSC and our stakeholder community please visit: https://www.pcisecuritystandards.org/about\_us/cdn.shopify.com
View Report
Текущая редакция от .