Shopify Payments is a payment processor that Shopify owns and runs itself

When you buy something from a store built on Shopify, Shopify Payments is often the system handling your card details. Instead of the store using a separate payment company like Stripe or Square, Shopify processes the transaction directly. This means your card information goes to Shopify's servers rather than bouncing between multiple companies.

The practical difference is simpler checkout and lower fees for the store owner — but it also means one company holds more of your transaction data. Shopify Payments is available in the United States, Canada, Australia, the United Kingdom, and a few other countries, but not everywhere.

Key Takeaways

  • Shopify Payments processes your card directly through Shopify rather than routing it through a separate payment processor, which can mean faster checkout but concentrates your data with one company.
  • Your card details are encrypted in transit and Shopify is required to meet PCI DSS standards, the same security baseline that applies to all major payment processors.
  • Shopify stores your payment method on file if you choose, which speeds up future purchases but means your card data persists on their servers until you delete it.
  • You have no direct relationship with Shopify Payments — disputes and refunds go through the store you bought from, not Shopify.
  • If a Shopify store is compromised, Shopify Payments data could be exposed, but the encryption and PCI requirements limit what attackers can actually use.

How your card data moves through Shopify Payments

When you enter your card number at checkout, your browser encrypts it before it leaves your computer. That encrypted data travels to Shopify's servers, where it stays encrypted until the transaction is processed. Shopify does not store your full card number after the purchase — they store a token, a unique code that represents your card without containing the actual digits.

If you save your card for future purchases, Shopify stores that token on their servers. The next time you shop at that store, your browser retrieves the token and sends it instead of your card number. This is faster than re-entering your card, but it also means Shopify keeps a record of which cards are linked to which stores.

Shopify is required to meet PCI DSS (Payment Card Industry Data Security Standard), the same compliance standard that applies to Stripe, Square, and every other major payment processor. This means regular security audits, encryption requirements, and rules about who can access card data. Meeting PCI DSS does not make a company unhackable, but it does set a floor for how they handle your information.

What happens if a Shopify store gets hacked

If a store built on Shopify is compromised, the attacker gains access to the store's customer database — names, email addresses, order history. But they do not automatically get your card number, because Shopify Payments does not give the store access to full card details. The store only sees the token.

An attacker could use the stolen email addresses and order history to target you with phishing emails or to try the same password on other sites. They cannot use the token to charge your card directly — tokens only work on the specific store they were created for. However, if Shopify's own servers are breached (a much rarer event), the tokens themselves could be exposed, which would be a more serious problem.

Your best protection is to use a unique, strong password for each store where you save your card, and to monitor your card statements for charges you did not make. If you see fraud, contact your card issuer, not Shopify — your card company is responsible for disputing unauthorized charges.

Shopify Payments versus other payment methods on Shopify stores

Some Shopify stores offer multiple payment options: Shopify Payments, PayPal, Apple Pay, Google Pay, or other processors. When you choose PayPal, your card details go to PayPal instead of Shopify. When you choose Apple Pay or Google Pay, your card is tokenized by Apple or Google, and the store never sees your actual card number at all.

From a security standpoint, Apple Pay and Google Pay add an extra layer — your phone or device authenticates the purchase, not just your card number. PayPal adds distance between the store and your card. Shopify Payments is the most direct route: your card goes straight to Shopify's system.

The choice often comes down to what the store offers and what you prefer. If you are buying from a store you trust and you want the fastest checkout, Shopify Payments is safe. If you want to limit how many companies hold your card data, PayPal or Apple Pay might feel better. There is no universally "best" option — it depends on your own comfort level.

Saving your card on Shopify stores and what it costs you

When you check the box to save your card, Shopify stores that token and links it to your account on that store. The next time you visit, checkout is one click. This is convenient, but it also means your card stays on file indefinitely unless you delete it.

To remove a saved card, log into your account on the store, go to your payment methods or saved cards section, and delete it. The exact steps vary by store, but most Shopify stores put this in account settings. Once you delete it, Shopify stops storing the token.

The trade-off is real: saving your card makes checkout faster, but it means Shopify keeps a record of your card as long as the store exists. If that store is breached, your saved card is part of what could be exposed. If you shop at many Shopify stores and save your card at each one, you have multiplied the number of places where your card data sits.

Why Shopify owns its own payment processor

Shopify built Shopify Payments to keep more of the transaction fee and to give store owners a simpler setup. When a store uses Stripe or Square, those companies take a cut. When a store uses Shopify Payments, Shopify keeps that cut. It is a business decision, not a security one.

For you as a customer, the main effect is that checkout may be faster and more integrated into the store's website. You are not filling out a form on a third-party site — you are entering your card directly on the store's page. This can feel more seamless, but it also means the store's design and security practices matter more, because your card data is going directly to Shopify through their system.

Frequently Asked Questions

Is Shopify Payments safer than PayPal or Apple Pay?

No single option is universally safer. Shopify Payments meets the same security standards as PayPal and other processors. Apple Pay and Google Pay add device-level authentication, which some people prefer. The real risk is not which processor you use, but whether the store itself is find and whether you monitor your statements.

Can I see which stores have my card saved?

Not in one place. You have to log into each store separately and check your account settings. If you have saved your card at many Shopify stores, you may not remember all of them. Consider deleting saved cards from stores you do not shop at regularly.

What if I see a charge I did not make?

Contact your card issuer when ready — they handle fraud disputes, not Shopify. Your card company can reverse unauthorized charges and issue you a new card. You can also report the fraudulent store to Shopify, but Shopify does not refund you directly.

Does Shopify Payments work outside the US?

Shopify Payments is available in the US, Canada, Australia, the UK, Ireland, and a few other countries. If you are in a country where Shopify Payments is not available, the store will use a different processor. Check the store's payment options at checkout to see what is offered.

If I delete my saved card, does Shopify still have it?

When you delete a saved card from your account, Shopify stops storing the token. However, Shopify may retain records of past transactions for accounting and legal reasons. Your actual card number was never stored — only the token — so deletion removes the active payment method.