PayProof · Shopify
Taking cards means PCI DSS obligations. The safe path: never touch raw card data, use a compliant processor, serve everything over HTTPS, never store card numbers, and complete your SAQ.
Shopify gives you the storefront and checkout, but legal compliance is on you, the merchant — Shopify's own terms make that explicit. The platform ships some tools (a cookie-banner and customer-privacy API, a hosted PCI-compliant checkout), but switching them on and configuring them correctly is your job, not Shopify's.
📦 On Shopify: Shopify gives you the storefront and checkout, but legal compliance is on you, the merchant — Shopify's own terms make that explicit. The platform ships some tools (a cookie-banner and customer-privacy API, a hosted PCI-compliant checkout), but switching them on and configuring them correctly is your job, not Shopify's. What Shopify handles: Shopify Payments and the hosted checkout cover much of your PCI DSS scope — but a self-hosted or third-party gateway, or custom checkout, pulls you back into scope.
This rule applies to Shopify sellers who accept credit or debit card payments. Accept card payments? Check that card data never touches your server and your checkout is locked down. Not sure? The free checker tells you in about a minute — no signup.
Whatever the platform handles, you still need to be able to answer "yes" to each of these — these are the points Shopify sellers most often get caught on:
⚠️ Exposure: card-network fines $5K–$100K/month (contractual) · Status: In force. On Shopify, that's on top of any account suspension for breaking platform policy.
Compare the penalty for every rule →
Shopify Payments and the hosted checkout cover much of your PCI DSS scope — but a self-hosted or third-party gateway, or custom checkout, pulls you back into scope.
If you accept card payments, yes — every merchant must meet PCI DSS. Using a hosted/tokenized processor (Stripe, PayPal, Shopify) keeps you in the lightest scope (SAQ A).
Let a compliant processor handle card data via a hosted or tokenized checkout so raw card numbers never hit your server, serve everything over HTTPS, and never store card numbers or CVV.
A Self-Assessment Questionnaire — an annual attestation of your controls. The version (A / A-EP / D) depends on how your checkout integrates.
RuleGoose checks this against the PCI DSS v4.0 standard. Read it yourself: PCI Security Standards Council →
or get one RuleGoose Score across every rule your Shopify store has to meet.
PCI DSS payment security is one of several rules a Shopify store has to meet. See the full Shopify compliance checklist →, or read the platform-neutral PCI DSS payment security guide.
Informational only, not legal advice, and not affiliated with the PCI SSC or Shopify. Last reviewed 2026-06-30.