Braintree PCI Compliance: Which SAQ Applies and When You Need an ASV Scan
Braintree PCI compliance explained: see which SAQ fits Hosted Fields, Drop-in or custom builds, and when quarterly ASV scans apply. Book an ASV scan today.
• Yes, with a limit: Shopify is validated as a PCI DSS Level 1 service provider, the highest tier, so the platform itself is PCI compliant.
• That certification doesn't transfer to your store. PCI compliance is a shared responsibility between Shopify and you.
• Most merchants on hosted checkout qualify for SAQ A, the shortest self-assessment, but your acquirer or processor decides what you must file.
• Your real exposure sits in what you add: third-party apps and scripts, staff access, card data taken outside checkout and connected systems.
• Keep a compliance file: Shopify's attestation of compliance, your SAQ, an app inventory and your access policy, reviewed at least once a year.
Is Shopify PCI compliant? Yes. Shopify is validated as a PCI DSS Level 1 service provider, and its hosted checkout keeps card numbers off servers you manage. But a compliant platform does not make your store compliant by default.
That gap matters. Card brands and acquiring banks enforce PCI DSS through their contracts with merchants, and non-compliance can mean fines, higher processing fees or, after a breach, liability for fraud losses and investigation costs. Most Shopify store owners never touch a card number, yet they still install apps, add tracking scripts, give staff admin access and sometimes take card details by phone or email. Each of those is yours to control.
This guide explains what Shopify PCI compliance covers, what you still own, which self-assessment applies and how to close the gaps without turning compliance into a second job. It draws on Shopify’s published security material and PCI Security Standards Council guidance; sources are listed at the end.
PCI DSS: The Payment Card Industry Data Security Standard, set by the PCI Security Standards Council. The current version is v4.0.1; the future-dated requirements in v4.0 became mandatory on March 31, 2025.
Service provider (Level 1): A company that handles card data for others and is independently assessed at the highest tier. Shopify holds this status.
Merchant level: A tier based on annual card transaction volume. It sets how you validate compliance, and it is separate from Shopify's own level.
SAQ: Self-Assessment Questionnaire. The form most small and mid-size merchants use to attest to compliance.
SAQ A: The shortest SAQ for merchants that fully outsource card handling to a hosted payment page.
AOC: Attestation of Compliance. The signed document proves a service provider (or you) passed validation.
Cardholder data: The card number and related data, such as expiry date and security code, that PCI DSS protects.
Web skimming: Malicious script code that copies card details as customers type them, often delivered through a compromised third-party script.
Yes. Shopify is a PCI DSS Level 1 service provider, the highest validation tier. That status covers Shopify’s platform, not your store’s own obligations.
When someone asks whether Shopify is PCI compliant, they usually mean two things: can I take cards on Shopify safely, and do I have to do anything about PCI myself? The first answer is yes. Customers enter card details on Shopify’s hosted checkout, so card numbers are processed and stored in an environment that is independently assessed against PCI DSS, not on a server you run.
The second answer is yes, but less than you would on your own. Shopify’s Level 1 status certifies Shopify’s infrastructure and payment processing. It does not certify your store, your apps or your business practices. The same hosted checkout serves every plan, from Basic to Plus, so the foundation is identical for all merchants. What changes is how much code, access and data you add on top.
Remember one rule: Shopify makes the hardest part of PCI easier, but it does not make the standard disappear.
Scan the apps and scripts on your cart and checkout pages for risks Shopify can’t cover for you.
Shopify’s certification covers its hosted checkout, card storage and transmission, and the infrastructure behind them, all validated by independent assessment against PCI DSS.
Shopify PCI DSS validation applies to the parts of the payment flow that Shopify operates:
• Hosted checkout and payment pages, where customers type card details.
• Card data handling, including secure storage, tokenisation and transmission when you use Shopify’s payment flow.
• Platform security controls, such as network protection, encryption, vulnerability management and logging.
• Independent, recurring validation against the current version of the standard, PCI DSS v4.0.1.
Level 1 describes Shopify’s tier as a service provider handling card data at very high volume. It is separate from your merchant level, which depends on your own annual card transactions. A small store on a Level 1 platform is normal, and the store still has its own validation duties.
You own your self-assessment, the apps and scripts you add, staff access, any card data handled outside checkout, and the systems that receive your order data.
The table below splits Shopify PCI compliance duties between the platform and you.
Area | Shopify | You (the merchant) |
|---|---|---|
Hosted checkout, card storage and transmission | Covered and validated | Use the hosted checkout; don’t build custom card forms |
Platform network security, encryption, vulnerability management | Covered | Nothing directly |
Annual validation of the platform | Covered | Keep the current attestation of compliance on file |
Your SAQ and attestation | Not covered | Complete and submit it if your acquirer requires it |
Third-party apps and custom scripts | Not covered | Vet, inventory and monitor them |
Staff accounts, permissions, passwords | Tools provided | Enforce two-step authentication and least privilege |
Card data taken by phone, email or chat | Not covered | Don’t store it; use a compliant virtual terminal or payment link |
Systems that receive your order data | Not covered | Secure your ERP, email, accounting and warehouse tools |
Policies and incident response | Not covered |
The rows marked Not covered are where merchants most often fall short. None of them is technically hard, but all of them need an owner, and on a small team that owner is usually you.
Most Shopify merchants on hosted checkout complete SAQ A, and Shopify’s attestation of compliance is the evidence for the parts Shopify handles. Your acquirer decides what you must submit.
SAQ A is the shortest self-assessment, built for merchants that fully outsource card handling. For a store using Shopify’s hosted checkout, it contains a small set of controls, compared with hundreds for a merchant that handles card data on its own systems (SAQ D). That’s why Shopify SAQ A is usually the answer.
Two cautions apply. First, eligibility depends on how you really take payments. Custom checkout code, embedded card fields or a headless shopfront can push you into a heavier questionnaire. Second, the PCI Security Standards Council revised SAQ A in January 2025 so that eligible merchants must confirm their site isn’t susceptible to attacks from malicious scripts. Some acquirers now also ask for a written responsibility matrix from your processor. Confirm exactly what yours expects.
Here is how to assemble the paperwork:
1. Ask your acquirer or payment processor which SAQ they require and by when.
2. Get Shopify’s attestation of compliance. Search for PCI compliance in the Shopify Help Centre, or ask Shopify support if you can’t find it.
3. Complete the SAQ based on how you take payments, not on how you wish you did.
4. Record which controls Shopify covers and which are yours.
5. Repeat every year and after major changes to your store.
Our guide to PCI compliance on Shopify walks through the SAQ step by step.
A one-page file you can hand to your acquirer, with every step in this guide.
Shopify’s certification doesn’t extend to apps and scripts you install. Each one is a vendor you must vet, inventory and monitor.
Most real-world card theft on e-commerce sites now happens in the browser rather than in a data centre. Web skimming works by slipping malicious code into a page, often through a compromised third-party script, so that card details are copied as customers type them. Reviews widgets, chat tools, analytics and marketing pixels all run code on your pages.
When you review PCI compliance Shopify apps, work through these steps:
• Keep an inventory of every app and script that loads on cart and checkout-related pages, with an owner for each.
• Remove what you don’t use. Uninstalled apps are one fewer vendor to trust.
• Vet vendors: check their security documentation, update history and the permissions they request.
• Monitor changes. Scripts can change after you approve them, so recheck on a schedule.
• Treat checkout customisations as in scope. On Shopify Plus, every extension you add to checkout deserves the same review.
This is also the control most often missed by merchants who assume the platform has them covered.
It can. Shopify Payments keeps the processing path inside Shopify’s validated environment, while a third-party gateway adds its own compliance status and requirements.
With Shopify Payments, card processing stays within Shopify’s certified environment, which is the simplest path. With a third-party gateway, customers still typically enter card details on Shopify’s hosted checkout, but your gateway has its own validation status and your processor may set separate requirements. Gateways that redirect customers to another page, or that embed card fields through custom code can change which questionnaire applies.
If Stripe is your provider, our guide to PCI compliance for Stripe explains how responsibility splits between you and Stripe. Whichever gateway you choose, ask the provider for its attestation of compliance and a clear statement of what it covers.
Keep Shopify’s attestation on file, confirm your SAQ with your acquirer, audit apps and scripts, secure staff access and keep card numbers out of email and chat.
For a deeper walkthrough, see our complete guide to Shopify PCI compliance.
Talk to a PCI specialist about your setup and close your gaps with confidence.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.