Shopify security assessmentsKnow what
needs fixing.
Understand your security risks. Get clear findings, practical next steps and help verifying the fixes.
A scoped review for merchants and app developers, covering the security areas we agree together. From account access and applications to customer data and operating practices.
Operated by Glotomati. Independent of Shopify.
01 Scope agreed before work starts02 Findings explained with evidence03 Fixes can be retested
For your part of the ecosystem
A useful review starts
with a clear scope.
We agree the areas, methods, access and exclusions before work begins. An unreviewed area is never treated as assessed.
For merchantsYour store and the
systems around it.
Review the security areas your team can act on, with findings you can share privately with your developer.
- Staff access, recovery and app permissions
- Storefront behaviour and integrations
- Customer data handling and operating practices
- Domain, email and incident readiness
These are possible review areas, not a promise that every engagement covers them all. Settings reviews require appropriate access or evidence. Shopify and third party systems outside your authority are excluded.
Discuss a merchant review ↗
For app developersYour app, release
and service environment.
Understand issues within an agreed app version and environment, including the boundaries between merchants.
- Authentication, sessions and permissions
- API access controls and tenant isolation
- Data handling and agreed backend components
- Release practices and vulnerability response
Methods may include authorised testing, code review and configuration evidence. The report identifies which methods were used. An app review does not assess every store that installs it.
Discuss an app review ↗ A practical service
Review. Fix. Recheck.
Assessment, retesting and ongoing monitoring have separate scopes. Choose the work that helps your team.
Agree the work
Define systems, methods, access, timing and fees. Written testing authorisation comes first.
Understand findings
Receive a private report with evidence, severity, limitations and recommended next steps.
Verify fixes
Ask us to retest identified issues. Retest notes say what was checked and what the result showed.
Keep checking
Optional monitoring covers agreed checks on a schedule. It does not repeat a full assessment or provide continuous protection.
Optional public recordScanned by
Plainsight.
With your approval, we can publish a short record on records.plainsightsecure.com saying that your store or app was scanned by Plainsight, and when.
The record explains what that means and what it doesn’t. It never shows what we found, how many issues there were or whether they were fixed. Your findings report stays private.
See a fictional example ↗ Scanned by PlainsightFICTIONAL EXAMPLE
- Store
- Example Store · example.com
- Scan dates
- When each scan finished
- Scope
- What was and wasn’t included
- What it means
- The scans were carried out
- Results
- Private to you, never published
Clear expectations
Useful evidence.
Honest boundaries.
Does “Scanned by Plainsight” mean a store is secure?
No. It means we carried out security scans within an agreed scope on the dates shown. It does not mean that no issues were found or that any were fixed, that the store or app is secure now, or that it is safe to shop with or install.
Can I link to my record?
Yes. Link the words “Scanned by Plainsight” to your record. Do not present it as certification, approval, protection or proof of safe shopping, and do not turn it into a badge or seal. The scan record linking policy explains permitted use.
What will you publish?
Only what you approve: your business name and domain, the scope of the scans and the dates they finished. Findings, issue counts, individual check results, credentials, personal data and exploit details stay in your private report. The record reads the same whatever we found.
Does monitoring keep an assessment current?
No. A record shows only the dates scans finished, and nothing is implied for other dates. Monitoring is a separate service with its own defined checks and schedule. It does not keep a broader assessment current.
Is this Shopify, PCI DSS, SOC 2 or privacy certification?
No. Plainsight is independent of Shopify. These assessments do not confer certification, regulatory approval or compliance status.
How does an engagement start?
Tell us about your store or app. We agree scope, timing, fees and a written engagement before testing. Sending this form does not authorise testing or publish a record.
Start with your questionsWhat would you
like to understand?
Tell us about your store or app and the security questions on your mind. We will discuss a useful scope and the evidence needed.
Assessment fees cover the agreed work. Publication is optional and requires your approval. Please do not send sensitive evidence through this form.