Shopify Payments vs Stripe: what each one leaves you to secure

The PCI table

Each row is a question a shop owner asks, with the requirement or form it maps to. “Ask the vendor” means the vendor's own pages did not say so when we read them on 2026-10-22; it does not mean no.

The split is clean. Shopify takes more of the store off your hands; Stripe tells you which SAQ your setup fits and helps you fill it in. Both let you download their own AoC once you log in. For the wider field judged the same way, see PCI compliant payment gateways.

Shopify Payments and Stripe, one by one

A hosted store or a store you build

These are not rival processors for the same store. Shopify Payments only works inside a Shopify store, and Shopify runs that store: its PCI page says “our certification covers your store, its shopping cart and web hosting.” Stripe goes into a store you build and host, and its Checkout puts the payment page “either embedded on your site or via a redirect to a Stripe-hosted page.” So the real question is how much of the website you want to own.

The PCI Security Standards Council's own examples of SAQ A cover both shapes. The first is the hosted one: “Merchant has no access to their webpage, and the webpage is entirely hosted and managed by a compliant TPSP/payment processor.” The others are a store that redirects to the processor or shows the processor's iframe. The line between SAQ A and the longer form is the payment page: if any element of the payment page delivered to the shopper's browser comes from the merchant's own website, SAQ A does not apply; SAQ A-EP may. Our SAQ A guide walks through that test line by line.

Who holds which piece

Requirement 12.8.5 asks you to record which requirements each provider manages, which you manage, and which you share. Here is that record for a small online shop. Pick how your custom store connects to Stripe and compare it line by line with a Shopify store. “You” means the shop owner.

Requirement counts: the Council's e-commerce table, SAQ Instructions and Guidelines v4.0.1 r1, p. 10. Stripe's SAQ names: its PCI guide.

More detail on the Stripe side is in is Stripe PCI compliant.

“PCI compliant by default”, read closely

“All stores powered by Shopify are PCI compliant by default so you can keep payment info and business data safe.”

Shopify, its PCI compliance page, read 2026-10-22

That is Shopify's claim, and it describes Shopify's side of the job: the platform, the cart and the hosting your store runs on. The Council's rule sits beside it. Requirement 12.8.1's note reads: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” The same note covers Stripe, Square and every other provider; it is why is Shopify PCI compliant comes with a condition.

Shopify's own checklist says much the same in its own words: “no matter which option you choose (even hosted), you'll still have to fill out a self-assessment questionnaire if you're a Level 2–4 merchant,” and “there are shared compliance responsibilities, but a PCI-compliant platform like Shopify takes care of the most challenging, resource-intensive, and expensive ones on behalf of the merchant.” Read together, the platform is covered and the yearly paperwork is still yours.

The paperwork each one hands you

Requirement 12.8.4 asks you to check each provider's status every year, so you need its proof. Shopify keeps its Attestation of Compliance in its Help Center: “The AoC is a form for Shopify to attest to the results of its annual PCI DSS compliance assessment,” and “You'll need to log on to your Shopify account to view this report.” Beside it sits “Shopify's quarterly attestation of Approved Scanning Vendor (ASV) scan compliance.”

Stripe's PCI FAQ says where its own proof sits: “You can verify at Visa's registry and download the AoC from your dashboard.” The same Dashboard is built for your side: a “customized wizard” that “will ask a series of questions and generate required documentation for you,” and a place to “upload any self-completed SAQ or ROC documentation.” Our guide to the Attestation of Compliance covers what the form holds and who signs it.

Questions