Is Shopify PCI compliant? What “by default” covers, and what stays yours

Shopify's answer, and the rule beside it

That is Shopify's claim, in Shopify's words. The same page adds “Yes, Shopify is certified Level 1 PCI DSS compliant” and says “our certification covers your store, its shopping cart and web hosting.” Read it as a statement about Shopify's side of the job: the platform your store runs on.

These lines do not contradict each other. Shopify carries the heaviest part, the card data path, and its checklist says so plainly: “there are shared compliance responsibilities, but a PCI-compliant platform like Shopify takes care of the most challenging, resource-intensive, and expensive ones on behalf of the merchant.” What stays with you is smaller, but it is not zero. The rest of this page walks through it part by part.

What Shopify's certification covers

Shopify's page names what its certification reaches: your store, its shopping cart and its web hosting, checked by “annual on-site assessments validating compliance.” On a Shopify store, the card number goes into Shopify's checkout and on to Shopify Payments. It never touches a server you run. That is why a Shopify store starts with so little PCI work. For the same picture set against a store you build yourself, see Shopify Payments vs Stripe.

Requirement 12.8.4 asks you to check each provider's compliance status “at least once every 12 months,” so you need Shopify's proof on file. Shopify keeps it in its Help Center:

In Shopify's words: “The AoC is a form for Shopify to attest to the results of its annual PCI DSS compliance assessment,” “Shopify reissues this form after each annual PCI DSS compliance assessment,” and “You'll need to log on to your Shopify account to view this report.” Next to it sits “Shopify's quarterly attestation of Approved Scanning Vendor (ASV) scan compliance.” Our guide to the Attestation of Compliance explains what the form holds.

Where the line runs: test yourself

The split is easy to misread either way: assume Shopify covers everything, or assume a Shopify store needs the same work as a store you built. Try the parts below before you read on. Each answer quotes the line it rests on.

The pattern is simple. Shopify owns what runs inside its checkout and its hosting. You own what you add to the store and what your people do: apps and scripts you install, readers on your counter, cards keyed in by staff, and the logins they use. Requirement 12.8.5 asks you to write that split down: “which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.”

Checkout apps and scripts on your other pages

Apps are where a hosted store grows back some scope. Shopify draws a clear line for apps that change the checkout:

The same docs say these extensions “run in an isolated sandbox, separate from the checkout page and other UI extensions.” Code you add yourself gets a plainer answer. On custom pixels, which can collect events “on even more pages of your online store, such as the checkout and post-purchase pages,” Shopify writes: “Compliance with applicable laws, consents, code security, troubleshooting, and updates are your responsibility.”

Why it matters for the paperwork: the SAQ A eligibility test, in the Council's words, includes “The merchant has confirmed that their site is not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s).” Your theme pages are your site. And when the Council took the payment-page script rules out of SAQ A in January 2025, it said the change does “not remove or diminish the underlying requirements within PCI DSS.” Our SAQ A guide covers that criterion line by line.

Shopify POS hardware at the counter

Selling in person moves the card off the screen and into a device in your shop. Shopify's card reader page lists the readers it supports; none of them is described there in PCI terms.

We checked the Council's list of validated P2PE solutions (138 solutions on 2026-10-22): no company named Shopify appears on it. That matters for SAQ P2PE. A PCI-listed P2PE solution “can significantly help to reduce the PCI DSS validation effort of a merchant's cardholder data environment,” but only a solution on the Council's list qualifies a merchant for SAQ P2PE; an “encrypted reader” that is not listed does not. Shopify's pages we read do not name the SAQ for its readers, so ask Shopify and your acquirer which one fits. Background: what P2PE is.

Whatever the form, the reader on your counter is in your hands. The standard's device rules (9.5.1) “apply to deployed POI devices used in card-present transactions”: keep “An up-to-date list of POI devices” with make, model, location and serial number (9.5.1.1), and inspect the surfaces “to detect tampering and unauthorized substitution” (9.5.1.2).

Phone orders keyed into the admin

Shopify lets you take a card over the phone on a draft order. Its steps: “In the Payment section, click Collect payment, and then click Credit card,” then “Enter the customer's billing and credit card information.” Shopify adds: “You can accept manual payment by credit cards only through Shopify Payments.”

Here the card number passes through a person: your staff member hears it, maybe writes it down, and types it on a computer you own. Shopify's certification covers Shopify's systems, not that desk. The Council's form for keyed-in cards, SAQ C-VT, describes “Merchants that manually enter payment account data a single transaction at a time via a keyboard into a PCI DSS validated and compliant third-party virtual payment terminal solution, with an isolated computing device and a securely connected web browser.” Whether your acquirer treats the Shopify admin that way is a question for your acquirer.

Staff accounts

The admin is where orders, customers and keyed-in payments live, and every person with a login is a way in. Shopify's two-step authentication page draws the limits of what an owner can switch on: “Staff members can set up two-step authentication for their own individual accounts,” and “The store owner can't activate two-step authentication for any other staff member.” The exceptions: “To use Shopify Payments to accept payments requires you to activate two-step authentication on your Shopify account,” and “Stores on the Shopify Plus plan can require that all users in their organization use a secure sign-in method.”

Which of these rules sit in your SAQ depends on the form, and whether the admin counts as part of your cardholder data environment is a scope question. The 8.2.1 note itself leaves out “user accounts within point-of-sale terminals that have access to only one card number at a time.” Treat the admin as the place that holds your customers' orders, and the rules cost little to follow. Our PCI password requirements guide covers length, rotation and MFA in full.

Your yearly file

Put together, a small Shopify merchant's PCI year is a short folder, not a project. Keep this receipt where you keep the business papers.

The PCI compliance checklist turns your SAQ, once you know it, into a list you can tick through, and the PCI policy template gives you a written security policy to start from. For how other platforms word the same promise, see is Square PCI compliant and is Stripe PCI compliant.

Questions