Platform guide
Shopify PCI compliance: what Shopify covers, and what you still own
Shopify PCI compliance is a shared arrangement. Shopify states that it is validated as a PCI DSS Level 1 service provider, which covers its checkout. However, merchants still confirm their own practices each year.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What Shopify covers in Shopify PCI compliance
When customers pay through Shopify's own checkout, card data is handled on Shopify's systems. Therefore much of the heavy work sits with Shopify. See the Shopify PCI compliance page for its own statement.
What you still own in Shopify PCI compliance
Your responsibilities depend on how you run the store. So check each of these.
- Completing the questionnaire your acquirer asks for
- Not collecting card numbers by email, chat or phone
- Controlling staff and app access to the store
- Reviewing any custom scripts near checkout
- Keeping an incident response plan
Shopify PCI compliance check
Tick each statement that is true.
Your result appears here as you tick, so you can see what is still open.
Shopify PCI compliance: which questionnaire applies
Many Shopify merchants using only Shopify's hosted checkout fit SAQ A. However, side channels change that.
| Situation | Effect |
|---|---|
| Only Shopify checkout | Often SAQ A. |
| Phone orders keyed in | Adds another channel, often a longer form. |
| In-person with terminals | Terminal rules also apply. |
| Card data stored elsewhere | Usually SAQ D. |
Common Shopify PCI compliance mistakes
The most common mistake is assuming the platform covers everything. For example, a team that takes card numbers over the phone for custom orders has stepped outside Shopify's checkout. Also, unvetted apps with broad access add risk.
So review side channels once a year. A short list of how orders arrive keeps the questionnaire honest.
Where we help
We confirm your form, check side channels and prepare evidence. However, we are not a QSA, and we are not affiliated with Shopify. The standard is in the PCI SSC document library.
Also keep a copy of Shopify's current compliance statement with your records. Your acquirer may ask how you confirmed your provider's status, and a dated copy answers that quickly.
Shopify PCI compliance questions
Does Shopify PCI compliance mean we are compliant automatically?
No. Shopify covers its checkout, but you still confirm your own practices.
Which SAQ do Shopify merchants use?
Often SAQ A for hosted checkout only, but side channels can change it.
Do custom scripts affect Shopify PCI compliance?
Yes. Review anything that runs near checkout, because it can affect scope.
Are you a Shopify partner?
No. We are independent readiness consultants.
Related guides
Check your Shopify setup
Describe how orders and payments reach you. We reply in writing with your likely form and any gaps.
Ask us anything