← All report cards · Registry

Built from public records and checked 2026-10-22. Not an audit of Shopify. How scores are made · spotted a mistake? Tell us.
A
Websites

Shopify

Commerce platform for online and retail stores · Score 90/100 · Last checked 2026-10-22

The short version

Reasonable to use. Review Shopify's published subprocessor list if your data-processing terms require it.

Built from: public records, checked 2026-10-22.

Score breakdown

Security record91
Documented incidents and safeguards (public record, not a technical test)
Data jurisdiction88
Which laws and governments can reach your data
Ownership transparency90
How plainly the owner can be traced
Third-party exposure92
Documented analytics, advertising and attribution partners

Who owns it

Shopify→Shopify Inc.

Parent based in: 🇨🇦 Canada

Laws that can apply: PIPEDA

Where your data can go

WhoCountryWhy they are involved
Google Cloud Canada🇨🇦 Canada Cloud hosting and data processing
Amazon Web Services🇺🇸 United States Cloud hosting
Cloudflare🇺🇸 United States Load balancing and DDoS protection

Jurisdictions touched: 🇨🇦 Canada · 🇺🇸 United States

What the public record says

mediumTwo support staff tried to obtain merchant transaction records

Shopify said two members of its support team ran a scheme to obtain transaction records of fewer than 200 merchants, ended their access and referred it to law enforcement. Source

good to knowPublic bug bounty with rewards up to $200,000

Shopify runs a public bounty programme with rewards of up to $200,000. Source

good to knowPublishes its list of data subprocessors

Shopify's help centre lists its subprocessors, including cloud hosts, payment providers and AI vendors. Source

Sources

Ownership, locations and data partners come from the company's own pages and filings where they exist. Last checked 2026-10-22.