Shopify Security Audit and Compliance Specialists

Make sure they audit Shopify, not a generic website. Most ecommerce security advice assumes you run your own server, so a standard website security audit spends its time on hosting, patching and server settings. On Shopify, that's platform work Shopify does for you. Ask what they'd check under Settings → Apps and in your staff list: a Shopify-literate auditor talks about permissions, collaborator access and app data; a generic one talks about firewalls.

Get the scope in writing before you grant access. It should cover every area in the checklist below, name the dates, and say what the auditor may view but not change. Any mention of scanning or attacking Shopify's servers is a reason to walk away.

Ask how findings will be ranked. A former agency that still has full admin access matters more than any generic scanner warning. Findings should be ranked by what someone could actually do with them, each with the fix and who should make it.

Agree how they'll handle what they see. An audit exposes staff lists, app permissions and sometimes live API keys. Ask where the report will be stored and who can read it, and plan to rotate any credential the auditor viewed once the work ends.

Check they use Shopify's own records. Each user's login history shows their five most recent sessions, with IP address and location, and the user management activity log records accounts and roles being created, edited or deleted. An auditor who never opens either is guessing.

Walk away from guarantees. Nobody can promise an unhackable store. An auditor who does is selling reassurance, not a review.

People and permissions. Every staff account should belong to a current person with only the access their role needs. Departed staff and former agencies get removed, not left dormant. Two-step authentication is set per user, and only Plus can require a secure sign-in method for everyone, so on other plans someone has to check each account.

Collaborators. Outside developers belong on collaborator accounts rather than shared logins. Access lapses after 90 days without a login, which clears out the forgotten ones. An agency that still logs in now and then keeps its access until you remove it.

Apps and AI tools. Settings → Apps shows each app's permissions and activity. The audit asks what each app can reach, whether it's still used and who approved it, and unused apps come out. AI tools with store access get exactly the same review.

Theme code and scripts. Every third-party script in the theme needs an owner and a reason. Since the old checkout scripts were retired on every plan, anything that tracks buyers in checkout is now a sandboxed pixel or an app extension. The audit lists each one, which customer events it receives and who controls it.

Custom apps and keys. Each API credential needs a named owner, the narrowest access that works and a plan for rotating it.

Incident response. Who gets called, which credentials are rotated first, and how you'd use the store activity log to see recent admin changes.

Price follows scope, and the biggest variable is how much custom code you run. Typical market ranges, plus the starting prices security specialists list on shopexperts:

The audit is the core of the work, but it often continues past the report: