- Short answer
- Yes, though not publicly: SOC 2 Type 2 and SOC 1 Type 2 aren't on Shopify's public reports page; only SOC 3 is marked freely shareable
- Asked for SOC 1
- Named in the Help Center, not on Shopify's security page
- View Report, signed in
- On reports shown only after sign-in, opens a Terms of Service notice: keep the report confidential
- Plan, staff role
- Neither is named on the Shopify pages we read on October 18, 2026
- What SOC 2, SOC 3 cover
- Shopify's service, per its security page; we read that as not your apps, team access or processes
- PCI evidence
- A separate AoC
Which SOC reports does Shopify have?
Shopify's Help Center lists four SOC documents on its own service, and only its SOC 3 entry says the report “can be freely shared”. Read signed out on October 18, 2026, Shopify's reports page shows SOC 3 as “publicly accessible” and none of the others.
- SOC 3: the one to pass on to a customer
- SOC 2 Type 2: security and availability safeguards, with an audit opinion
- SOC 2 bridge letter: covers the gap after the SOC 2 period ends
- SOC 1 Type 2: safeguards for merchant financial reporting, with an audit opinion
Asked for SOC 1? Shopify's security page names only SOC 2 Type II and SOC 3, so cite the Help Center for SOC 1 Type 2.
How do you view the SOC 2 and SOC 1 reports?
Sign in on Shopify's compliance reports page, which says some reports are accessible only with an active Shopify account. It doesn't say which, and we read it signed out, so check your own view. On reports that need sign-in, View Report opens a Terms of Service notice that reads:
This report is to be kept confidential in accordance with your confidentiality obligations.
The Shopify pages we read on October 18, 2026, staff permission pages included, name no plan or staff permission for viewing these reports.
Where the U.S. appendix of Shopify's Data Processing Addendum applies, Shopify will, “upon reasonable written request,” “provide the SOC2 report” to help you ensure it uses your customer personal data consistently with U.S. data protection laws.
What Shopify's SOC 2 and SOC 3 reports don't cover
Shopify's security page says its SOC 2 Type II and SOC 3 reports are “for the service we provide to our customers”. We read that as Shopify's own service, not your apps, team access or processes, so answer those parts of a questionnaire yourself, starting with what customer data an app can access.
PCI evidence is a separate AoC; see where Shopify's PCI proof lives.
This page was written by AI. Separate AI agents that did not write it check its figures and claims against official sources and test its links and interactive tools. A human editor sets the site's editorial direction, topics and rules and checks that pages are complete and display correctly, but does not check their facts or edit their text. Details may change — always confirm critical data at shopify.com.
Editorial Policy