What we can show you, not just tell you

PCI scope

Checkout is a full redirect to a provider-hosted page — Stripe Checkout Sessions or a Razorpay Payment Link — for every order, on every storefront. Our servers never receive a card number, CVV or expiry date; there is no embedded card field anywhere in the product, and the part of the platform that handles payments has no place to store card details. That puts us in the easy end of PCI DSS: SAQ-A eligibility, the questionnaire for merchants who fully outsource cardholder-data handling to a redirect or iframe they do not control the content of.

What we have not done is file a completed SAQ-A / Attestation of Compliance with an acquirer, or collect Stripe's and Razorpay's own AoCs on file — that is a paperwork step for whichever entity is the merchant of record, not a code change, and we say so here rather than implying it is already done.

Multi-tenant data isolation

Each store's data is kept apart by the database itself, not only by application code: every request is limited to one store before it reads or writes anything. The platform checks that this isolation is in force when it starts and again before it serves requests, and refuses to serve a request if it cannot prove the isolation holds. We have tested this against both our production and staging databases.

Backups & disaster recovery

Our database has continuous point-in-time recovery: every change is copied to durable storage as it happens, not once a night. To restore, we recover the database to a chosen moment and point the platform at it, following a written procedure that includes re-checking that each store's data is still kept apart.

What we are not overstating: our exact retention window and a fully timed restore rehearsal are still open items, so we don't claim them here. We would rather tell you that plainly than publish a recovery-time number we have not measured.

Performance under load

A peak-season cutover is the second most common reason a replatforming project fails, by the industry's own accounting — so we test for it rather than assert it. We keep a checkout load benchmark, with its method written down, so the results can be reproduced rather than taken on faith. Ask us for the latest results and when they were run.

Migration scope

Single-locale only today. If your Shopify store publishes more than one language or market (Shopify Markets, Translate & Adapt), we will not promise a migration for it yet — this platform has no locale/translation layer, so a second language's indexed URL tree (already ranked, already carrying backlinks) has no destination page to 301 to. Promising otherwise and discovering the gap after signing is worse than saying so up front. Every readiness scan, run before you commit to a date, checks the source store's published locale count and quotes this same answer as a blocker when it finds more than one.

Payment market. We settle payments through exactly two gateways: Stripe (USD, GBP, EUR, AUD, CAD) and Razorpay (INR only). If your store settles in a currency neither gateway processes — including one served today only by a local acquirer such as Payfast, Paystack, PayU or Mollie — we cannot take the migration until that gateway is implemented. This is checked automatically for every readiness scan and quoted as a blocker, never left to sales judgment.

Subscriptions and card-on-file. Subscription and recurring-billing catalogs are explicitly out of scope today. Shopify has stated since July 2022 that a stored payment method cannot be exported to a new gateway, so honoring an existing subscription means re-collecting a card from every subscriber — the fastest way to lose the customers a migration is meant to keep. The one exception is a merchant whose subscriber card tokens already live in their own payment gateway rather than Shopify's vault; that is a fact about your own setup we ask about directly rather than one our scan can detect.

Gift cards, point of sale, and B2B wholesale. Point-of-sale hardware and B2B company/price-list structures have no automatic equivalent here and are rebuilt by hand on the destination platform. Gift cards are different: Shopify only ever releases a card's balance and the last 4 digits of its code, never the full code, so we import the balance as store credit on the matched customer and send a re-issue-new-codes email — a real, concierge-assisted migration path rather than a silent gap.

Sub-processors

The services that process data on our behalf, platform-wide:

• Neon — Postgres database hosting
• Vercel — application hosting and edge network
• Microsoft Azure — image and video storage and delivery; Redis caching and rate limiting; error monitoring and alerting (Application Insights)
• Resend — transactional email delivery
• Stripe — payment processing (redirect checkout)
• Razorpay — payment processing (redirect checkout)

Security practice

We do not hold a SOC 2 report today, and we would rather say that directly than let silence read as a claim. What we do have: a STRIDE threat model covering the platform's trust boundaries, an independent security review with a signed advisory on file, and an audit trail recorded for every privileged action taken in the backstore — who did what, to which tenant, and when.

Our deprecation policy

The single most common grievance from teams forced off another platform's checkout was not the rewrite itself — it was getting roughly a month's notice to do it. We are committing to something different in writing: we will not force a breaking rewrite of your storefront, checkout, or integration surface on short notice. Any change that requires you to modify code you own will be announced with a minimum of 90 days' lead time, will ship with a migration guide, and — for as long as it is technically possible to do so safely — will run alongside the surface it replaces rather than replacing it outright on a deadline.

Incidents

We monitor the platform continuously (error tracking, uptime checks against the same probe this page's status widget reads) and record every privileged Backstore action to an audit trail. We do not yet publish a historical incident log or an uptime history on this page — the status widget above reflects only the current moment, not the last quarter — and we have noted that gap here rather than implying otherwise.