Is Shopify a secure solution?
Considered one of the leading B2C e-commerce CMS, the Canadian solution Shopify is remarkably straightforward.
Shopify is utilized in nearly 175 countries worldwide, predominantly in English countries. In 2020, the company empowered over 2,000,000 merchants.
It is therefore crucial that the platform is secure, ensuring constant availability, high performance, and resilience against data theft or intrusions.
In this article, we will explore the following:
- General architecture of Shopify
- Technical commitments of Shopify to ensure security
- Security certifications of Shopify
- Our points of focus to ensure perfect security
General Architecture of Shopify
Hosting
Shopify is a SaaS (Software as a Service) system, developed in Ruby on Rails and hosted in the cloud, with no possibility for developers to modify the core of the system. This is a quality guarantee compared to open-source platforms where the core can be changed, potentially leading to future maintenance complexities.
It is also a significant security assurance, as no vulnerabilities are possible at the core application level, given its hermetic nature.
The cloud system is highly performant, relying on the Google Platform with hosting zones in the United States, Europe, and Australia.
Cloud hosting zones currently available on the Google Platform:
This system allows for robustness during peak loads such as Black Friday or for Christmas period, thanks to an elastic Cloud architecture: The more people enter the store, the larger the store becomes.
This is a significant distinction from “on-premise” hosted systems that require boosters or optimizations before commercial operations to avoid degradation or service interruptions.
As a certified Shopify Plus agency, having implemented over 30 Shopify Plus projects, we have never observed performance issues regardless of our clients’ commercial periods.
Content Distribution
Hosting is managed in three major geographic zones, and media (photos and videos) are replicated in CDNs, managed by Cloudflare, across the globe, spanning nearly 300 replication points that ensure excellent loading times for visitors worldwide.
For instance, if your site is hosted in Europe and you have a visitor from Japan, they will download media through the Tokyo CDN rather than the European zone.
Here’s the Cloudflare case study: Cloudflare Shopify Case Study
Here are the details of all replication points worldwide:
The use of CDN is inherent and included in all Shopify licenses, with no need for any action on your part or the agency’s side.
Key Technical Security Measures on Shopify
SSL Certificate (Secure Socket Layer)
Shopify uses SSL certificates to ensure a secure connection between the client’s browser and Shopify servers. This ensures data encryption during transmission. No need to purchase or configure external certificates; it is included in Shopify.
Protection against Brute Force Attacks
Shopify implements measures to prevent brute force attacks, where an attacker tries to guess a password by attempting different combinations.
Security Updates
Shopify proactively manages security updates to ensure that the platform is protected against known vulnerabilities.
Agencies don’t need to handle updates, except for very rare API changes that may become deprecated, affecting only those who have developed custom apps.
DDoS (Distributed Denial of Service) Attack Protection
Shopify employs strategies to minimize the impact of DDoS attacks, which aim to make a site unavailable by overwhelming its servers with excessive traffic.
For this, Shopify relies on Cloudflare to filter traffic and protect your services.
Data Encryption
All sensitive information, such as payment data, is encrypted to ensure confidentiality.
PCI DSS Compliance
Shopify complies with the Payment Card Industry Data Security Standard (PCI DSS), meaning it adheres to security standards for credit card transactions.
Fraud Protection
Shopify employs fraud detection systems to identify and prevent suspicious transactions.
Here is an example of a fraud report, enabling the e-commerce merchant to form an opinion on whether to accept the sale or not.
Two-Factor Authentication (2FA)
Shopify offers two-factor authentication to enhance the security of merchant accounts. At DATASOLUTION, we strongly encourage our clients to enable 2FA on their accounts.
Security of Third-Party Applications
Shopify has established security standards for third-party applications to ensure they do not compromise the platform’s security.
Third-party applications only have access to APIs, meaning they can only read, modify, or delete data to which you grant access. This allows for isolating changes made by a third-party application.
Privacy and Compliance Policies
Shopify has strict privacy policies and complies with data protection regulations.
Security Certifications of Shopify
PCI Certification
The Payment Card Industry Data Security Standard (PCI DSS) is a security standard for organizations that store, process, or transmit credit card information. The standard aims to strengthen controls around payment data to reduce fraud.
PCI reports provide an assessment of an organization’s compliance with PCI DSS requirements defined by the PCI Security Standards Council.
SOC Reports
Service Organization Control (SOC) reports evaluate an organization’s controls related to privacy, processing integrity, security, and availability.
All the reports can be consulted here.
Points of Attention for Ensuring Perfect Security
As you can see, security is at the core of Shopify’s philosophy, being a SAAS system responsible for over 2 million different websites and thus must be infallible.
However, we draw your attention to two external factors:
The Human Element
This advice holds true for all computer systems: extreme caution should be exercised with access, and strong authentication is not just recommended but mandatory. This entails connecting with a password reinforced by an SMS or an access key.
Shopify allows for granular management of employee access through role assignments. Therefore, the administrator must be vigilant about the permissions granted to various team members.
On the left, here is a screenshot of the possible rights per category.
And a screenshot of the possible rights with more precision.
It’s good to know that Shopify can connect to your active directory or LDAP via native connectors, which means that employee accounts can be created and deleted automatically as your team changes.
We hope this short guide has been useful in introducing you to the security aspects of the Shopify platform!
A project?
Discuss it with our Shopify experts
Yann FRESSIGNAUD
Managing director
