Shopify provides safeguards including encrypted communications, PCI DSS compliance to protect card information, and app security reviews. Third-party assessments and a program for accepting vulnerability reports from external researchers also provide evidence for evaluating its security.
When adopting Shopify, check whether these protections apply to the data your business handles and the payment methods and apps you use. Your business also has responsibilities, such as configuring authentication and permissions and reviewing orders before shipping. Fraud prevention and compensation for losses differ in their scope and eligibility requirements.
This article explains the scope of protection for the Shopify platform, payments, and apps, along with the conditions to check before adoption. It also presents the design and operational practices of RuffRuff apps as specific examples.
What Shopify protects and what to check before adoption
When deciding whether to adopt Shopify, review the safeguards provided and the areas your business will manage. Conditions vary by payment method and app, so reviewing the following areas separately can help you organize your assessment.
| Area | Safeguards and tools provided by Shopify | What to check before adoption |
|---|---|---|
| Card information and communications | PCI DSS-compliant payment infrastructure and TLS encryption | Check the scope of protection, including data handled by your business and external services |
| Fraudulent orders and chargebacks | Fraud analysis, blocking and compensation subject to conditions | Check fraud prevention for your payment methods and the eligibility requirements for compensation |
| Data access through apps | App Store reviews and requirements for permissions and data protection | Check the permissions of the apps you plan to use and their providers’ storage, deletion, and maintenance policies |
| Unauthorized access to the admin | Two-step authentication, passkeys, and permission settings | Decide who will use the admin and which authentication methods and permissions they will use |
| Accidental deletion and settings changes | Tools such as CSV exports and saving themes | Check which data you can save and how much you can restore |
Shopify platform protection and third-party assessments
Evidence for assessing Shopify’s security includes compliance with card information protection standards, third-party assessment reports, and published technical and operational safeguards. Check the scope of data and services covered by each.
PCI DSS compliance and SOC reports
Shopify states that it is PCI DSS Level 1 compliant, meeting an international standard for protecting card information. Its 2026 Attestation of Compliance is based on PCI DSS v4.0.1 and covers services including Shopify Payments, online stores, and the Shop Pay wallet.
Shopify also obtains SOC 2 Type II and SOC 3 reports in which a third party assesses the controls and operation of its information systems. The public SOC 3 report covers April 1, 2025, through March 31, 2026. These reports do not guarantee that future incidents will not occur, including in systems independently connected by a store.
TLS encryption for communications
Communications with the Shopify admin and stores use TLS, an encryption technology that helps prevent eavesdropping and data tampering. Shopify supports TLS 1.2 or higher.
Domains added to Shopify automatically receive free TLS certificates. For domains purchased through external services, issuing a certificate can take up to 48 hours. Images and other externally loaded assets must also be served over HTTPS and configured so that they do not interfere with secure connections.
Vulnerability assessments, change management, and attack protection
As part of its measures to protect personal data, Shopify describes restricting access to personnel who need it, conducting vulnerability assessments and penetration tests, and logging, testing, and approving system changes. It also maintains disaster recovery, business continuity, and security incident response plans.
Online stores are continuously protected by a WAF that inspects malicious traffic and defenses against DDoS attacks, which attempt to disrupt services with large volumes of traffic. Shopify’s guidance on bots states that these protections require no action from the store.
hCaptcha, which is enabled by default, also helps prevent spam in contact and comment forms and customer accounts. Separately, additional bot protection for checkout during sales events is available only on Shopify Plus.
Payment security for Shopify Payments and Shop Pay
Shopify Payments provides fraud prevention measures and features that help assess order risk. Stores decide whether to ship suspicious orders and must separately check eligibility requirements for chargeback compensation.
Card information protection and 3D Secure
Shopify Payments and Shop Pay apply safeguards for card information, including PCI DSS compliance. Store owners must also comply with the Shopify Payments terms, including managing account access and not storing card security codes.
Shopify Payments automatically uses 3D Secure authentication based on factors such as card issuer or regulatory requirements and situations considered high risk. An additional authentication screen is not displayed for every payment. Authenticated transactions are generally eligible for a liability shift for fraudulent chargebacks, but exceptions apply, and this does not remove liability for every dispute, including those involving products not received.
Fraud analysis, card testing prevention, and rule-based controls
Shopify Payments includes protection against card testing, in which stolen card information is tested through small payments or similar transactions. Fraud analysis also provides risk information for eligible online card orders to help with checks before shipping. The analysis does not conclusively determine fraud or compensate for losses, so stores need to review order details.
Fraud Control is available on all store plans in regions where Shopify Payments is offered and displays fraud-related insights. Some data is unavailable if you do not use Shopify Payments.
Stores using Shopify Payments can also use rules to block checkouts that meet specified conditions. Review the conditions carefully when configuring rules, as they can also block legitimate orders. The following article explains specific checks to perform before shipping.
Shopify Protect features and compensation requirements
In its October 28, 2026 announcement, Shopify introduced Shopify Protect as an initiative bringing together fraud prevention, risk explanations, and support for responding to chargebacks. The announcement includes upcoming features, so check the guidance for each feature to confirm whether it is available.
Fall ’26 Editions introduces features such as blocking high-risk orders before payment authorization, adding evidence, and using AI to help draft chargeback responses. Customizable fraud prevention rules and the expansion of chargeback protection to orders outside Shop Pay also include announcements of upcoming availability. Check the latest guidance for each feature to confirm availability and compensation requirements for stores in Japan.
Financial compensation for orders has separate requirements. The help page on order protection lists conditions including being located in the United States with a US Shopify Payments account and having an eligible Shop Pay order. Requirements also include physical products that require shipping, supported tracking information, fulfillment within 7 days of the order, and the shipment being in transit within 10 days.
Orders containing digital products or products for in-store pickup, Shop Pay Installments, and the second and subsequent subscription orders are among the exclusions. When an eligible fraudulent chargeback occurs on a protected order, the amount and associated fees are covered.
Enabling Shop Pay does not automatically enroll stores located in Japan in this compensation coverage. Check the Protect status of each order and the latest requirements to determine eligibility.
Shopify’s security requirements for apps
When choosing apps, review the permissions requested during installation and the provider’s data handling policies. The Shopify App Store reviews apps before publication, and developers must continue to maintain security safeguards after publication.
Pre-publication reviews and minimum necessary data access
Apps published on the Shopify App Store must meet minimum security requirements. Common checks include protection against common vulnerabilities, TLS use, preventing exposure of unnecessary ports, and secure generation and handling of authentication tokens. In addition to the pre-publication review, developers must maintain these safeguards after publication.
When an app accesses protected customer data, requirements include data minimization, limiting the purposes of use, and protecting stored data and communications. Public apps must request access separately for names, addresses, email addresses, and phone numbers. Depending on the category of data accessed, requirements can also include backup encryption, access logs, and incident response policies.
Data access and deletion requests, and request authentication
Apps distributed through the App Store must implement notifications for customer data requests, customer data erasure, and store data erasure, regardless of whether they collect personal data. Developers verify notification signatures and respond to requests for the data they handle.
Requests must also be validated when an app reads or updates data. Shopify provides guidance on authenticating every request and requires apps to be designed to handle only data belonging to the authenticated store. Also check the app provider’s explanation of which data is deleted and the deletion process.
What your business should prepare for ongoing operations
Before adoption, identify who will use the admin, which apps you will use, and who will review and ship orders. Deciding on the settings needed to use Shopify’s protection features and assigning responsibility for daily operations helps clarify the work required after adoption.
Set up two-step authentication and backup login methods
Shopify provides two-step authentication, which verifies your identity using another method in addition to a password. Two-step authentication must be enabled to accept payments with Shopify Payments. SMS cannot be set up as a new authentication method, but accounts that already have SMS configured can continue to use it.
As an alternative to passwords, passkeys let you log in with methods such as facial or fingerprint recognition. They are configured separately from two-step authentication, and Shopify recommends setting up two-step authentication in addition to passkeys. Prepare backup authentication methods and recovery codes in case you lose your device.
For instructions on setting up two-step authentication with an authenticator app, see the following article.
Review staff permissions and activity logs
Give staff the permissions needed for their work, and review them when staff leave or change responsibilities. Shopify Plus organization features include enforcing secure login methods across an organization and integrating with an internal identity infrastructure for login and user management.
The store activity log is also useful when investigating settings changes or permissions granted to apps. The new activity log is being rolled out gradually; check which information is available and the applicable requirements for your store.
Define procedures for apps, orders, and backups
Review the permissions and provider security policies of apps you install. Continue to check notices displayed in the Shopify admin after you begin using them. Reassess whether you need unused apps, and check their impact on data and functionality before removing them.
Review order risk information before shipping, and establish procedures for identity verification and putting suspicious orders on hold. Back up the data you need in case products or themes are accidentally deleted. You need both server redundancy and preparations for restoring data affected by user error.
The following article explains manual backup methods and how to choose a backup app.
RuffRuff’s own safeguards in addition to Shopify requirements
The 7 RuffRuff apps provided by our company, Tsun Inc., meet Shopify’s security requirements and also apply our own design and operational safeguards. We publish our data handling, development, and production operation policies on the RuffRuff security page.
Minimize stored data and limit permissions to what is needed
RuffRuff limits API permissions to the scope required for its features and uses access tokens that expire after 1 hour and IP allowlists. These measures address Shopify’s requirements.
Our design policy is not to store customer names, addresses, email addresses, phone numbers, or card information on Tsun’s servers. App settings are stored within Shopify, and the settings used for app operation use dedicated metafields that only the app itself can modify. Accessing data needed for a feature is different from storing it on Tsun’s servers.
Continuous checks and restricted production access
During development and operations, we run the official security checks when making changes and conduct regular, detailed reviews using AI. We receive vulnerability alerts for external software used by our apps and update it according to its impact. Our policy is to investigate the impact of disclosed vulnerabilities on our apps and publish notices even when they are unaffected.
Our production environment cannot be operated from regular accounts. Authorized personnel use dedicated accounts to access it only for the time needed. We also have a policy of not providing production login credentials to internal AI tools.
We delete data for uninstalled stores from the app database. The cumulative purchase data for each customer that the Order Limits app records within Shopify is deleted in response to customer data erasure requests. When choosing apps, checking which data a provider stores, where it is stored, and how the provider conducts checks and responds to incidents, alongside its compliance with Shopify requirements, can help you make a decision.
Addressing vulnerabilities with external researchers through bug bounties
Shopify operates a bug bounty program that accepts reports of vulnerabilities found by external researchers and pays rewards subject to its conditions. As of November 13, 2026, the published maximum bounty is US$200,000. Reports are submitted through HackerOne and evaluated based on their impact and the applicable conditions.
The published response process includes reproducing reports, checking for duplicates, assessing impact, deciding on bounties, fixing issues, and retesting. This provides a framework for continuous improvement based on external reports.
Shopify-built apps and third-party apps have different reporting channels and eligibility conditions. The program criteria state that issues in third-party apps should first be reported to the developer and can be reported to Shopify if there is no response after 1 week. No bounties are paid for vulnerabilities in third-party apps. Testing is limited to stores you create yourself in accordance with the program criteria; accessing or operating other people’s stores is prohibited.
Stronger safeguards required of app developers
Shopify is also strengthening requirements for apps after publication. The following are developers’ responsibilities; stores should check providers’ guidance and other information to confirm the compliance status of apps they plan to use.
IP allowlists and expiring access tokens
Shopify is strengthening protection for connections to the Admin API, which apps use to read and write store data. IP allowlists restrict API connections to registered addresses or networks.
Expiring access tokens place a time limit on credentials used to access APIs, reducing the risk that leaked credentials will remain usable. Migration to expiring tokens is also required for offline access tokens, which are used for processing while the app is not open.
These are requirements for developers to address. Store owners should check the compliance status shown in app settings in the Shopify admin and the provider’s guidance.
As of November 13, 2026, the announcement making IP allowlists mandatory and the announcement on migrating to expiring offline access tokens specify the following schedule.
| Measure | Main scope | Deadline and required action |
|---|---|---|
| IP allowlists | Public apps that call the Admin API | November 20, 2026, at 23:59 ET. November 21 at 13:59 JST |
| Early enforcement of IP allowlists | Public apps that use bulk operations for batch data processing | November 12, 2026, at 23:59 ET. November 13 at 13:59 JST. Bulk operations are blocked for noncompliant apps |
| Expiring offline access tokens | Existing public apps subject to the migration deadline | The migration deadline is January 1, 2027. Already required for applicable public apps created on or after April 1, 2026 |
Measures such as delisting and blocking new installations are scheduled to be introduced in phases for noncompliant apps. Affected Admin API requests from existing installations will begin failing on April 1, 2027, with earlier restrictions for bulk operations. The expiring token migration announcement states that custom apps and apps created by store owners are excluded.
Shopify also provides developers with official security checks. This tool combines automated code checks with agent reviews that evaluate implementation details. Its use supports development; it does not mean that all public apps have undergone the same checks.
Retiring the legacy method of adding scripts to stores
Shopify is also moving forward with the deprecation of ScriptTags, the legacy method apps use to load JavaScript into stores. ScriptTags can no longer be created or updated from October 1, 2026, and existing ScriptTags will no longer be injected into storefronts from March 1, 2027.
Developers are advised to migrate to theme app extensions or web pixels, depending on the use case. App embeds in theme app extensions can be checked in the theme editor and enabled or disabled there. Store owners should ask their app providers whether migration is needed and which settings are required in the live theme.
Declaring network destinations and verifying developer identity
The October 2026 app security updates introduced configuration for declaring the network destinations and other resources used by apps. Developer identity verification is also being strengthened and is to take place before apps are installed on development stores or client transfer stores.
The testing preview for development stores announced on November 4 warns about undeclared network traffic. It does not block traffic during testing. Developer identity verification and code security reviews are also separate procedures.
Define your business requirements for the adoption decision
List the payment methods and apps you will use, the types of data you will handle, and the people who will use the admin, and check the scope of protection and terms of use for each. If internal policies require audit materials or data storage conditions, confirm before adoption that your chosen configuration can meet them.
Understanding what standard safeguards cover and which tasks your business and app providers are responsible for also helps you assess the operational workload after adoption. Server costs and procedures for checking outages are explained in the following article.
