Most Shopify merchants assume the platform handles everything security-related. It handles a lot — but not everything. Understanding where Shopify’s responsibility ends and yours begins is the first step in protecting your store and your customers.
Shopify’s Responsibility vs Yours
| Area | Shopify handles | Store owner handles |
|---|---|---|
| Hosting infrastructure | DDoS protection, server patches, uptime | Nothing |
| Checkout security | PCI DSS Level 1, TLS encryption, card tokenisation | Not adding insecure third-party checkout scripts |
| Admin access | Account login infrastructure | Strong passwords, 2FA, staff permission scoping |
| Installed apps | Basic app review process | Vetting app permissions; removing unused apps |
| Customer data handling | Encrypted storage, GDPR data export tools | Privacy policy, lawful basis for marketing, retention limits |
| Fraud prevention | Shopify Protect (eligible orders) | Manual review rules, address verification, high-risk order decisions |
Two-Factor Authentication
Enable 2FA on every admin account without exception. Go to your Shopify admin, click your account name, then Manage account, and turn on two-step authentication. Require it for all staff under Settings > Users and permissions. An authenticator app (Google Authenticator or Authy) is more secure than SMS, which is vulnerable to SIM-swap attacks.
Staff Permission Best Practices
Give each staff member only the permissions they need for their role. A customer service rep does not need access to payment details or export of customer lists. Shopify’s granular permissions let you restrict individual sections. Review staff accounts quarterly and remove anyone who has left the business immediately — former employees retain access until explicitly revoked.
Third-Party App Risk
Every app you install gets API access to your store. Some request far broader permissions than they need. Before installing any app, check: what permissions it requests, when it was last updated, how many active installs it has, and whether it has a clear privacy policy. Uninstall apps you no longer use — they retain API tokens until manually removed from Settings > Apps and sales channels.
PCI DSS Compliance
PCI DSS (Payment Card Industry Data Security Standard) governs how card data must be handled. Shopify Payments and Shopify’s hosted checkout are PCI DSS Level 1 certified, meaning Shopify manages the heavy compliance burden. Your obligation is to avoid doing anything that breaks that certification — specifically, never capture or log raw card numbers through custom code, custom forms, or third-party scripts injected into the checkout page.
Shopify Protect for Fraud
Shopify Protect automatically covers eligible orders against chargebacks for fraud. It is available on Shopify Payments in supported markets. An order shows a green “Protected” badge when it qualifies. You do not need to do anything for covered orders — if a chargeback arrives on an eligible order, Shopify handles it and you keep the revenue. For orders outside Shopify Protect’s coverage, set up manual review rules: flag orders where billing and shipping country differ, or where the IP geolocation does not match the billing address.
Frequently Asked Questions
Can my Shopify store be hacked?
The server infrastructure cannot be compromised by merchants or their customers. However, your admin account can be accessed if credentials are weak or 2FA is off, and malicious apps can abuse API access. Securing admin access and vetting apps covers the vast majority of real-world risk.
Does Shopify comply with GDPR?
Shopify provides GDPR-compliant tools (data export, deletion requests, consent tracking). However, GDPR compliance is the store owner’s legal responsibility. You must have a lawful basis for processing customer data, maintain a privacy policy, and honour deletion requests within 30 days.
How do I check if an app is safe to install?
Check the app’s privacy policy link, its last update date in the App Store, the permissions it requests during installation, and its review count. Apps with thousands of reviews and recent updates from known developers carry lower risk than obscure apps requesting full store access.
Ready to Grow Your Shopify Store?
Our Shopify experts at OneOnic have helped hundreds of brands launch, optimise, and scale. Let’s talk about your project.
