Shopify security assessmentsKnow what
needs fixing.
Understand your security risks. Get clear findings, practical next steps and help verifying the fixes.
A scoped review for merchants and app developers, covering the security areas we agree together. From account access and applications to customer data and operating practices.
Operated by Glotomati. Independent of Shopify.
01 Scope agreed before work starts02 Findings explained with evidence03 Fixes can be retested
For your part of the ecosystem
A useful review starts
with a clear scope.
We agree the areas, methods, access and exclusions before work begins. An unreviewed area is never treated as assessed.
For merchantsYour store and the
systems around it.
Review the security areas your team can act on, with findings you can share privately with your developer.
- Staff access, recovery and app permissions
- Storefront behaviour and integrations
- Customer data handling and operating practices
- Domain, email and incident readiness
These are possible review areas, not a promise that every engagement covers them all. Settings reviews require appropriate access or evidence. Shopify and third party systems outside your authority are excluded.
Discuss a merchant review ↗
For app developersYour app, release
and service environment.
Understand issues within an agreed app version and environment, including the boundaries between merchants.
- Authentication, sessions and permissions
- API access controls and tenant isolation
- Data handling and agreed backend components
- Release practices and vulnerability response
Methods may include authorised testing, code review and configuration evidence. The report identifies which methods were used. An app review does not assess every store that installs it.
Discuss an app review ↗ A practical service
Review. Fix. Recheck.
Assessment, retesting and ongoing monitoring have separate scopes. Choose the work that helps your team.
Agree the work
Define systems, methods, access, timing and fees. Written testing authorisation comes first.
Understand findings
Receive a private report with evidence, severity, limitations and recommended next steps.
Verify fixes
Ask us to retest identified issues. Retest notes say what was checked and what the result showed.
Keep checking
Optional monitoring covers agreed checks on a schedule. It does not repeat a full assessment or provide continuous protection.
Optional public check historySee the checks.
Over time.
With your approval, we can publish a history on records.plainsightsecure.com showing which agreed checks ran, when they ran and what each one reported.
Each result belongs to a specific check and its stated pass criterion. Detailed findings stay private. A passed check is not an overall security rating.
See a fictional example ↗ Public check historyFICTIONAL EXAMPLE
- Subject
- Example Store · example.com
- Run history
- Dates and times of recorded checks
- Individual results
- Passed · Needs attention · Not completed
- Pass criteria
- What each check actually establishes
- Findings
- Shared privately with the merchant
Clear expectations
Useful evidence.
Honest boundaries.
Does a passed check mean the store is secure?
No. Passed means that one check met its stated criterion when it ran. The page does not label the store or app as having passed overall. It does not establish that the business is free of vulnerabilities, remains secure or is safe to transact with.
Can I link to my record?
Yes, using factual wording such as “View our Plainsight check history.” You must not present it as certification, guaranteed protection or proof of safe shopping. The check history linking policy explains permitted use.
What will you publish?
Only an approved summary: the named subject, dated runs, individual check results, pass criteria, scope and limitations. Checks that need attention or could not complete remain visible. Credentials, personal data, exploit details and the private findings report stay private.
Does monitoring keep an assessment current?
No. Each recorded run describes only its checks at that time. Gaps have no implied result. Monitoring is a separate service with defined checks and frequency and does not keep a broader assessment current.
Is this Shopify, PCI DSS, SOC 2 or privacy certification?
No. Plainsight is independent of Shopify. These assessments do not confer certification, regulatory approval or compliance status.
How does an engagement start?
Tell us about your store or app. We agree scope, timing, fees and a written engagement before testing. Sending this form does not authorise testing or publish a record.
Start with your questionsWhat would you
like to understand?
Tell us about your store or app and the security questions on your mind. We will discuss a useful scope and the evidence needed.
Assessment fees cover the agreed work. Publication is optional and requires your approval. Please do not send sensitive evidence through this form.