PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) is the international security standard for every business that processes, stores or transmits payment card data. The current version is PCI DSS v4.0.1. If you sell through Shopify Checkout, Shopify takes on the heaviest part: Shopify is certified as Level 1 PCI DSS compliant. Our guide to Shopify payments shows how this fits into your full payment setup.

In short

PCI DSS is the card brands' standard for protecting card data; the current version is v4.0.1.

Shopify is Level 1 PCI DSS compliant and covers hosting and checkout for every store.

You remain responsible for what you add yourself: access to your admin, apps, headless code and how you handle card data outside the checkout.

What exactly is PCI DSS?

PCI DSS is managed by the PCI Security Standards Council, founded by the major card brands. The requirements fall into six areas: network, protection of card data, vulnerabilities, access, monitoring and policy.

Version 3.2.1 was retired on 31 March 2024. Since 31 March 2025 the newer version 4 requirements are mandatory too, including 6.4.3 and 11.6.1: these cover monitoring scripts on payment pages, to prevent digital skimming.

PCI DSS on Shopify: what does Shopify handle?

Shopify is audited on site every year and is certified as Level 1, the highest level. That certification covers the hosting and checkout of every store on the platform. Card data therefore never ends up on your own servers.

Only approved code runs in the checkout. Customisations through Checkout Extensibility run in an isolated sandbox. According to Shopify, PCI DSS v4 therefore requires no extra work from merchants for the checkout itself. If you use an external payment gateway, that provider must be PCI certified itself; Shopify only lets such parties build card payment integrations.

What do you still need to do as a merchant?

Self-assessment on request. Your acquirer or payment provider may ask for a Self-Assessment Questionnaire (SAQ). If card processing is fully outsourced, this is usually SAQ A, the shortest questionnaire. Since 2025, SAQ A includes a criterion that your site is not susceptible to script attacks; a confirmation from your PCI-compliant provider can be enough for this.

No card numbers outside the checkout. Never record card details in emails, order notes or spreadsheets. Enter phone orders through the secure Shopify flow.

Limit access. Give every team member their own staff account with two-step verification and only the permissions they need.

Go headless with care. If you build your own storefront, keep payment running through Shopify Checkout. A custom payment form brings PCI responsibility back to you.

Example in a Shopify context

A Belgian fashion webshop sells through Shopify Payments with cards, Bancontact and Apple Pay. The card data stays in the Shopify checkout, secured with 3D Secure where the bank requires it. The team sets up personal accounts with two-step verification and keeps card numbers out of the customer service inbox.

Frequently asked questions

What does PCI DSS stand for?

PCI DSS stands for Payment Card Industry Data Security Standard. It is the security standard the card brands impose on anyone who processes, stores or transmits payment card data.

Is Shopify PCI DSS compliant?

Yes. Shopify is certified as Level 1 PCI DSS compliant and is audited annually for it. The certification applies to the hosting and checkout of every Shopify store.

Do I need to fill anything in for PCI as a Shopify merchant?

Sometimes. Your bank or payment provider may ask for a self-assessment. Because Shopify handles card processing entirely, this is usually the short SAQ A. If in doubt, ask your provider which form applies.

What is the difference between PCI DSS and PSD2?

PCI DSS is a card brand standard for securing card data. PSD2 is European legislation on payment services, which includes strong customer authentication for online payments.

With Shopify Payments, card processing sits with Shopify; what that costs per payment is in Shopify Payments fees and rates. The rules for strong customer authentication are in our explanation of PSD2.