Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Shopify
PCI DSS evidence
Shopify Inc. is a Canadian multinational e-commerce company headquartered in Ottawa, Ontario that operates a cloud e-commerce management
VerifiedShopify and PCI DSS
Shopify is listed in the Visa Global Registry of Service Providers for PCI DSS (Listed on the Visa Global Registry as PCI DSS validated through 2027-06-30), dated 27 Oct 2011, assessed by Coalfire Systems, Inc. CertReports last verified this on 2 Nov 2026 from the registry.
Evidence
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-06-30
as of 2 Nov 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 8 Jul 2013
- Expires or valid through
- 30 Jun 2027
- Auditor or assessor
- Coalfire Systems, Inc
- Scope
- PAYMENT FACILITATOR, MERCHANT SERVICER - VISA
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 2 Nov 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 804b6fa48a |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 26 Oct 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 88d6fc201b |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-07-31
as of 2 Nov 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 5 Jun 2017
- Expires or valid through
- 31 Jul 2027
- Auditor or assessor
- Foregenix Ltd.
- Scope
- HIGH INTEGRITY RISK PAYMENT FACILITATOR, PAYMENT FACILITATOR
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 2 Nov 2026 | Pay Now Ltd (Zambia): PCI DSS, assessor Foregenix Ltd., valid through 2027-07-31 | Live pagesha256 e77158acd1 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 26 Oct 2026 | Pay Now Ltd (Zambia): PCI DSS, assessor Foregenix Ltd., valid through 2027-07-31 | Live pagesha256 8f44114f77 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 5 Oct 2026 | SHOPIFY INC.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 46d1169fcf |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 29 Sep 2026 | SHOPIFY INC.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 fcbd28993e |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-03-31
as of 2 Nov 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 13 Apr 2011
- Expires or valid through
- 31 Mar 2027
- Auditor or assessor
- Evolution Ltd.
- Scope
- MERCHANT SERVICER - VISA
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 2 Nov 2026 | Adflex Limited: PCI DSS, assessor Evolution Ltd., valid through 2027-03-31 | Live pagesha256 0fbf147389 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 26 Oct 2026 | Adflex Limited: PCI DSS, assessor Evolution Ltd., valid through 2027-03-31 | Live pagesha256 9124468c6a |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 19 Oct 2026 | Euronet Worldwide: PCI DSS, assessor INTEGRITY360 EUROPE LIMITED, valid through 2027-07-31 | Live pagesha256 356ab951bc |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 12 Oct 2026 | NCR Voyix Corporation: PCI DSS, assessor Aprio, LLP, valid through 2027-03-31 | Live pagesha256 9a54472e46 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 5 Oct 2026 | Virtual Card Services Botswana (Pty) Ltd.: PCI DSS, assessor Foregenix Ltd., valid through 2027-07-31 | Live pagesha256 7e8bcbfc3c |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 29 Sep 2026 | Virtual Card Services Botswana (Pty) Ltd.: PCI DSS, assessor Foregenix Ltd., valid through 2027-07-31 | Live pagesha256 edc80f3553 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 17 Sep 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 4caceaccf2 |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-06-30
as of 2 Nov 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 27 Oct 2011
- Expires or valid through
- 30 Jun 2027
- Auditor or assessor
- Coalfire Systems, Inc
- Scope
- MERCHANT SERVICER - VISA
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 2 Nov 2026 | SHOPIFY INC.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 804b6fa48a |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 26 Oct 2026 | SHOPIFY INC.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 88d6fc201b |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-03-31
as of 2 Nov 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 23 Feb 2007
- Expires or valid through
- 31 Mar 2027
- Auditor or assessor
- MCI Communications, Inc. dba Verizon Business Services
- Scope
- PAYMENT FACILITATOR
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 2 Nov 2026 | Galaxia Moneytree Co. Ltd.: PCI DSS, assessor MCI Communications, Inc. dba Verizon Business Services, valid through 2027-03-31 | Live pagesha256 473ec762ef |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 26 Oct 2026 | Galaxia Moneytree Co. Ltd.: PCI DSS, assessor MCI Communications, Inc. dba Verizon Business Services, valid through 2027-03-31 | Live pagesha256 9b551d5da7 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 19 Oct 2026 | PT. NUSA SATU INTI ARTHA: PCI DSS, assessor SISA, valid through 2027-09-30 | Live pagesha256 3851eb5375 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 12 Oct 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 cbbc556637 |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2026-12-31
as of 2 Nov 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 12 Jun 2025
- Expires or valid through
- 31 Dec 2026
- Auditor or assessor
- atsec (Beijing) Information Technology Co., Ltd
- Scope
- MERCHANT SERVICER - VISA
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 2 Nov 2026 | DiDi Mobility Pte. Ltd.: PCI DSS, assessor atsec (Beijing) Information Technology Co., Ltd, valid through 2026-12-31 | Live pagesha256 1d6d3ec35a |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 26 Oct 2026 | DiDi Mobility Pte. Ltd.: PCI DSS, assessor atsec (Beijing) Information Technology Co., Ltd, valid through 2026-12-31 | Live pagesha256 150a8ab9d7 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 12 Oct 2026 | SHOPIFY INC.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 cbbc556637 |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-06-30
as of 19 Oct 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 8 Jul 2013
- Expires or valid through
- 30 Jun 2027
- Auditor or assessor
- Coalfire Systems, Inc
- Scope
- PAYMENT FACILITATOR, MERCHANT SERVICER - VISA
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 19 Oct 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 7ffd8205f8 |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-07-31
as of 19 Oct 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 3 Jun 2024
- Expires or valid through
- 31 Jul 2027
- Auditor or assessor
- Foregenix Ltd.
- Scope
- MERCHANT SERVICER - VISA, PAYMENT FACILITATOR, HIGH INTEGRITY RISK PAYMENT FACILITATOR
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 19 Oct 2026 | DIRECT PAY LIMITED: PCI DSS, assessor Foregenix Ltd., valid through 2027-07-31 | Live pagesha256 26f56e9f77 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 5 Oct 2026 | Shopify Payments EU Limited: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 46d1169fcf |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 29 Sep 2026 | Shopify Payments EU Limited: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 fcbd28993e |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2026-11-30
as of 5 Oct 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 18 Nov 2022
- Expires or valid through
- 30 Nov 2026
- Auditor or assessor
- SRC Security Research & Consulting GmbH
- Scope
- HIGH INTEGRITY RISK PAYMENT FACILITATOR, CRYPTO RAMP PROVIDER
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 5 Oct 2026 | Moneytea Ltd: PCI DSS, assessor SRC Security Research & Consulting GmbH, valid through 2026-11-30 | Live pagesha256 27b8a71a48 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 29 Sep 2026 | Moneytea Ltd: PCI DSS, assessor SRC Security Research & Consulting GmbH, valid through 2026-11-30 | Live pagesha256 80ef5aa773 |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 17 Sep 2026 | SHOPIFY INC.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 4caceaccf2 |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-06-30
as of 5 Oct 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 8 Jul 2013
- Expires or valid through
- 30 Jun 2027
- Auditor or assessor
- Coalfire Systems, Inc
- Scope
- PAYMENT FACILITATOR, MERCHANT SERVICER - VISA
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 5 Oct 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 46d1169fcf |
Visa Global Registry of Service Providers Official registry · HTTP 200 | 29 Sep 2026 | Shopify Payments (USA) Inc.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 fcbd28993e |
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-06-30
as of 17 Sep 2026 · confidence 100%- Kind
- Attestation
- Issued or listed
- 21 Jul 2026
- Expires or valid through
- 30 Jun 2027
- Auditor or assessor
- Coalfire Systems, Inc
- Scope
- PAYMENT FACILITATOR
| Source | Captured | Quote | Links |
|---|---|---|---|
Visa Global Registry of Service Providers Official registry · HTTP 200 | 17 Sep 2026 | Shopify Payments EU Limited: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-06-30 | Live pagesha256 4caceaccf2 |
What is not public
- The Visa registry lists the assessor and the date the validation runs through, not the services in scope of the attestation of compliance.
What PCI DSS means, and what it does not
Only a registry listing (Visa Global Registry, Mastercard SDP) or an AOC letter is strong evidence. In the Visa registry only rows validated as PCI DSS with a validation date count; Third Party Agent registrations are not PCI evidence.
Read the PCI DSS guide and browse all vendors with evidenceQuestions buyers ask
Is Shopify PCI DSS compliant?
Shopify is listed as a PCI DSS validated service provider, assessed by Coalfire Systems, Inc, valid through 30 Jun 2027, as of 2 Nov 2026.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 12 Oct 2026PCI DSS auditor changedAuditor changed from Foregenix Ltd. to Coalfire Systems, Inc.
- 29 Sep 2026PCI DSS renewedExpiry moved from 2027-06-30 to 2027-07-31.
- 29 Sep 2026PCI DSS auditor changedAuditor changed from Coalfire Systems, Inc to Foregenix Ltd..
- 22 Sep 2026Trust centre movedTrust centre URL is now https://www.shopify.com/.
- 19 Sep 2026Trust centre movedTrust centre URL is now https://www.shopify.com/security.
Alternatives with PCI DSS evidence
Similar vendors (shared product tags or the E-commerce category) whose PCI DSS row is verified or vendor-stated, ranked by similarity.
Lightspeed POS
E-commerce
Lightspeed Commerce is a point-of-sale and e-commerce software provider based in Montreal, Quebec, Canada
VTEX
E-commerce
Modernize your stack and drive operational results with an AI-Native unified commerce
BigCommerce
E-commerce
BigCommerce, founded in 2009, is a leading open software-as-a-service (SaaS) ecommerce platform that empowers merchants of all sizes to
EVONET GLOBAL
E-commerce
Evonet is a global payment solution for gaming, AI, SaaS, and e-commerce, connecting merchants with local payment methods with secure
LYRA COLOMBIA
E-commerce
We are your trusted partner for payment collection for e-commerce sites, click & collect, call centers, delivery and in physical
eVance
E-commerce
Our Offers All-In-One ecommerce solutions ZERO CAPITAL INVESTMENT Why buy eCommerce software, when you can pay as you go? OLB is a leading
SHARE COMMERCE SDN BHD
E-commerce
Elevate your business with our secure payment platform in
Valor PayTech
E-commerce
Boost revenue with Valor PayTech’s flexible payment solutions, built to power in-person, mobile, and e-commerce transactions with ease and
Understand PCI DSS evidence
All articlesExplainers
ISO 27001 Annex A: What Buyers Should Actually Ask For
Solomon Amos · 23 Oct 2026 · 9 min read