Give customers and merchants a clearer reason to trust you.
Independent security certification for Shopify stores and apps. From account access and third party code to customer data and incident response.
A program by Plainsight, operated by Glotomati. Independent of Shopify.
Merchants protect their customers. App developers protect the businesses that depend on them. Both deserve a meaningful security standard.
A security assessment of your store, its integrations and the practices your team uses to protect customer data.
Issued for a named store and its assessed configuration. Covers technical findings and documented operating controls.
Explore merchant certificationAn assessment of your app’s security, from installation and authentication to backend controls, customer data and releases.
Issued for a named app, assessed release and service environment. A certified app does not certify every store that installs it.
Explore app certificationSecurity spans people, software and operations. Each area requires evidence, assessment and a reviewer’s decision.
Review owner, staff and collaborator access. Require multifactor authentication for privileged accounts, appropriate permissions, secure recovery and a process for promptly removing access when someone leaves.
Inventory installed apps, scripts and connected services. Review permissions, business purpose, data destinations and vendor ownership. Remove unused access and investigate undeclared integrations.
Assess the theme, public pages, forms, transport security and checkout handoff for vulnerable behaviour, injected content, suspicious scripts and unexpected redirects. Review custom components within the agreed testing scope.
Review where customer data is collected, stored, shared and exported. Check access restrictions, retention, deletion and secret handling. Record which controls the merchant owns and which are provided by Shopify or another vendor.
Review monitoring and escalation, backups for merchant controlled assets, evidence of recovery exercises and a named incident owner. Maintain daily storefront checks and a process for investigating security alerts.
Resolve and retest critical and high severity findings. Document other findings with owners and due dates. Reassess material changes to access, apps, themes or data flows; a monitoring gap over 48 hours triggers suspension and review.
Merchant assessment combines technical checks with evidence of store settings and operating practices. We agree access and testing boundaries in advance, use synthetic data and never request account passwords. Shopify’s underlying platform is treated as a service dependency, not a system we independently certify.
Assess installation and OAuth flows, session handling, webhook verification and API permissions. Test access controls across agreed roles and tenant boundaries so one merchant cannot access another merchant’s data.
Map sensitive data and secrets through collection, storage, transfer, logging, retention and deletion. Review encryption, access controls, uninstall cleanup and the app’s stated data handling commitments.
Review agreed frontend, API and backend attack surfaces using code review and authorised security testing. Investigate injection, unsafe inputs, exposed secrets and business logic weaknesses with synthetic data.
Review production access, multifactor authentication, environment separation, cloud configuration and dependency risk. Require evidence of change approval, release integrity, patching and rollback procedures.
Inventory delivered scripts and remote dependencies. Compare observed network, form and navigation behaviour with the app’s declarations. Review how settings can alter code and what remains after uninstall.
Review security logging, alert ownership, recovery evidence, vulnerability reporting and merchant notification procedures. Resolve and retest critical and high severity findings, and reassess material releases or infrastructure changes.
App assessment covers the agreed release, configurations and supporting service environment. The scope record names the repositories, endpoints, roles and deployment boundaries reviewed, along with limitations. Testing requires written authorisation and an agreed environment.
Assessment references: OWASP Application Security Verification Standard and PCI SSC guidance on payment page security. They inform the criteria; this program does not grant OWASP endorsement or PCI DSS compliance.
Confirm ownership, systems, app release, test conditions, evidence access and fees. Written authorisation comes before any assessment.
Combine technical security assessment with configuration review and evidence of operating controls. Share findings privately with your team.
Address blocking findings and retest. A named human reviewer records the decision against each applicable criterion.
After approval, receive a scoped certificate and a badge linked to its verification record. Maintain the required controls and renew with fresh evidence.
Every issued badge must link to a verification record on our domain. Visitors should be able to see exactly what was reviewed and whether the certificate is still current.
No. This is an independent program offered by Plainsight, operated by Glotomati. It is not affiliated with or endorsed by Shopify, and it does not grant Built for Shopify status.
Certification means the assessed store or app met the published security standard and remains subject to maintenance requirements. Security assessments and monitoring reduce uncertainty; they cannot guarantee that an attack will never occur. The public record explains the assessed scope, dates and any limitations.
No. The app review covers a specific release and configuration. Your store has its own theme, integrations and scripts, so merchant certification requires a separate assessment.
No. This is a separate security certification against Plainsight’s published standard. It does not replace PCI DSS validation, a SOC 2 report or a legal determination of privacy compliance.
You receive the findings and the evidence needed to understand them. Fix the blocking issues and request a reassessment. Fees cover assessment work, not a guaranteed badge. Disputed findings can be submitted for a documented reconsideration before a final decision.
Request an assessment for your store or app. We will agree the scope, fees, monitoring arrangements and assessment terms with you before work begins. The initial conversation is free and creates no commitment.
Tell us whether you run a store or build an app. We will discuss the right scope and what you would need to prepare.
Start with a conversation. We will agree the scope and fees with you before any assessment begins.