This may have been true in the past, however per https://www.shopify.com/security https://www.shopify.com/security they are SOC2-certified (SOC2 is significantl

This may have been true in the past, however per https://www.shopify.com/security https://www.shopify.com/security they are SOC2-certified (SOC2 is significantly more common in North America), they are certainly PCI Level 1, and have GDPR/CCPA compliance requirements. You can also see their 2019 Transparency Report: https://www.shopify.com/security/transparency-report/report-2019 https://www.shopify.com/security/transparency-report/report-.... It is still possible that their SOC2 and PCI reports could have a number of exceptions, but I would be surprised at this point in their maturity cycle.