E-Commerce Platforms & Shop Systems

Shopify

Rest of world Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: 1 of 4 dimensions proven

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

An AI-assisted analysis of public evidence — not a hands-on test.

Every score, rationale and verdict on this page is AI-generated. Every claim cites the source it was read from. Nothing here is a human star review — and no score can be bought. How scores are made →

Method and versions

The Merchant v1.0 · The B2B Seller v1.0 · The Developer v1.0 · The Operations Lead v1.0 · The Data Protection Officer v1.0 · The Skeptic v1.0 · rubric v1 · evaluated 28 Sep 2026

Compare with JTL-Shop → Compare with WooCommerce → Report an error on this page Is this your product? →

Read this page as one judge. Each weighs the same scores by what they care about.

The Data Protection Officer

Weighted verdict

The shop holds customers, addresses and buying histories, and the checkout is full of third parties. Wants the subprocessor list, consent handling that survives a complaint, deletion that executes against order history, and an answer on where the CDN and analytics sit.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The Data Protection Officer

Catalogue & checkout

How this is scored

Products, variants, pricing rules and the path to payment — the part that either converts or does not.

0 — Flat product list with one price and no variants; checkout is a form and one payment method.

3 — Variants and categories with a standard checkout and two or three payment methods, but no bundles, no tiered pricing and no guest checkout worth the name.

5 — Full variant matrix, product bundles, tiered and customer-group pricing, guest checkout, and the payment methods a German shop needs including invoice and direct debit.

8 — Configurable products, per-channel pricing, promotions and vouchers with rules, a checkout that can be customised without a rebuild, and payment via the major providers plus buy-now-pay-later where offered.

10 — Merchandising and checkout are the product: rule-driven pricing and promotions, A/B-testable checkout, multi-currency and multi-language as standard, and conversion features (abandoned cart, one-page checkout) shipped rather than bolted on.

Report an error

The Data Protection Officer

The captured pages evidence a checkout with conversion claims, Shop Pay, customisation limited on standard plans and full on the top plan, B2B catalogues, localized selling through Shopify Markets, and checkout inside AI chat channels. We found no public information on variant matrices, product bundles, tiered pricing, abandoned-cart tooling, or the payment methods a German shop needs such as invoice and direct debit. 1 2 2

Report an error

Tax & German legal correctness

How this is scored

VAT determination, OSS, B2B reverse charge, and the checkout requirements German law actually imposes — judged on what the platform does, not on a plugin someone could buy.

0 — A single VAT rate applied everywhere; no B2B handling, no country logic, no legal-text handling in checkout.

3 — Per-country VAT rates configurable by hand, net prices for B2B possible with effort, and legal texts as free-form pages.

5 — Automatic VAT by destination and customer type, VAT-ID validation with reverse charge, gross and net display per customer group, and the mandatory checkout elements (order button wording, withdrawal policy, price indications) handled.

8 — OSS thresholds tracked and reported, correct invoicing per case including reverse-charge notes, small-business and third-country handling, and e-invoicing (XRechnung/ZUGFeRD) for B2B orders.

10 — Tax and legal correctness are maintained by the vendor rather than the merchant: rates and thresholds updated as the law moves, OSS reporting produced, every invoice case correct out of the box, and documented conformity a lawyer could review.

Report an error

The Data Protection Officer

The captured pages are silent on VAT determination by destination, OSS reporting, B2B reverse charge, VAT-ID validation and the mandatory German checkout texts; the closest facts are B2B catalogues limited by plan and PCI-DSS Level 1 certification for payment security. We found no public information on how German tax and checkout legal correctness is handled. 2 2

Report an error

Extensibility & developer surface

How this is scored

Themes, apps, APIs and headless — whether the shop can be shaped to the business, and at what cost in lock-in.

0 — Fixed templates, no app ecosystem, no API.

3 — Theme editing within limits and a small app store; a read-mostly API and no local development story.

5 — Custom themes with a template language, an app or plugin ecosystem, a documented REST API, and webhooks for the core order events.

8 — Full storefront API for headless builds, an extension framework with its own lifecycle, staging environments, version control for themes, and documented rate limits.

10 — A platform a team can own: headless-first APIs, open-source or source-available core, plugin architecture with a real dependency model, local development and CI supported, and upgrade paths that do not orphan customisations.

Report an error

The Data Protection Officer

The developer surface is evidenced: more than 21,000 apps, Hydrogen for headless builds, the Universal Commerce Protocol with APIs and tools, and documented API rate limits scaled by plan up to ten-fold on the top plan. Headless storefront counts are metered per plan, and we found no public information on staging environments, theme version control, or a source-available core the merchant could run. 1 2

Report an error

Order operations & back office

How this is scored

What happens after checkout: order management, stock, returns, shipping, and the link to ERP or accounting.

0 — An order list and an email; stock is a number nobody trusts, returns are manual.

3 — Order statuses and basic stock, one shipping integration, and returns handled by hand.

5 — Order workflow with partial shipments, multi-warehouse stock, named carrier integrations with label printing, and a returns process in the system.

8 — Multi-channel order intake, automated fulfilment routing, supplier and dropshipping flows, and maintained interfaces to named ERP and accounting systems.

10 — The shop is the front of an operation: real-time stock across channels and warehouses, returns and refunds fully worked including partials, ERP integration the vendor maintains, and operational reporting a merchant runs the business from.

Report an error

The Data Protection Officer

After checkout the pages evidence multi-location inventory (ten locations on standard plans, 200 on the top plan), synced marketplace orders with a free monthly quota, Shopify Collective for sourcing, online-offline POS sync and over 200 real-time reports. We found no public information on returns and refunds handling, carrier integrations with label printing, or maintained interfaces to named ERP and accounting systems. 1 2 2

Report an error

Data ownership & exit

How this is scored

Whether the catalogue, customers and order history remain the merchant's: export completeness, hosting choice, and what leaving actually costs.

0 — Export is a partial CSV; order history and customer records cannot leave intact, and hosting is the vendor's alone.

3 — CSV export of products and customers, order history partial, no self-hosting, no documented migration path.

5 — Complete export of catalogue, customers and orders via API or dump, documented deletion, and a stated data-return commitment.

8 — Full-fidelity export including media and order documents, self-hosting or a choice of hosting partner, and no metering that prices a migration out of reach.

10 — Ownership is structural rather than promised: open-source or source-available platform the merchant can run anywhere, database-level access, documented migration in both directions, and contractual data return.

Report an error

The Data Protection Officer

Leaving is documented but slow: a closed store's information is retained for two years before the deletion process begins, deletion or anonymisation on closure is promised, and portability to another provider is listed among the rights with a request portal. The subscription bundles the vendor's own hosting, and we found no public information on export completeness for catalogue, customers and order history, on a self-hosting option, or on a documented migration path. 3 3 2

Report an error

European sovereignty

How this is scored

Where customer and order data live, who the contracting entity is, and which subprocessors sit in the checkout path. Independently sourced by the sovereignty pipeline.

0 — Non-EU vendor and contracting entity, hosting unstated or non-EU, subprocessors unnamed.

3 — EU hosting offered as an option while the contracting entity is non-EU, or the subprocessor list is absent.

5 — EU hosting as standard and an EU contracting entity, but parts of the chain — CDN, analytics, payment routing, support tooling — are non-EU without an explained safeguard.

8 — EU hosting on named infrastructure, EU contracting entity, complete subprocessor list published, any non-EU processing named with its legal basis.

10 — Sovereign end to end and evidenced: vendor, entity, hosting and every subprocessor European, certification published, and a self-hosted option that puts the shop entirely under the merchant's control.

Report an error

The Data Protection Officer

For EEA, UK and Swiss users the contracting recipient is Shopify International Ltd. in Dublin, but the policy states data then flows to other Shopify locations and service providers including Canada and the USA, covered by SCC-equivalent clauses and approved binding corporate rules. Subprocessors appear only as categories — cloud hosting, content delivery, data analysis, internal logging, fulfilment services, email transmission — and we found no public information on a named subprocessor list, on where hosting sits, or on where the CDN and analytics run. 3 3

Report an error

Pricing transparency

How this is scored

Whether a merchant can compute the real annual cost — licence, transaction fees, apps, hosting — from public pages alone. The category where the headline price is least often the invoice.

0 — No public prices at all; every tier is a sales conversation.

3 — A monthly headline exists, but transaction fees, mandatory apps or hosting costs are unstated — the invoice is unknowable from the page.

5 — Tier prices public with billing period stated and transaction fees given, but at least one commonly needed piece (a required app, hosting, payment gateway rate) is unpriced.

8 — Every tier priced publicly including transaction or revenue-share rates, order or GMV limits, and the cost of the extensions most shops need; VAT treatment and minimum term stated.

10 — Complete price computability: annual cost derivable for a given order volume and GMV including licence, transaction fees, hosting and typical extensions — and for open-source platforms, an honest statement that the licence is free and where the money actually goes.

Report an error

The Data Protection Officer

Tier prices are public with the billing period stated — 27 €, 79 € and 289 € per month billed annually — and transaction fees are given per plan for standard cards, Amex and external payment providers, alongside the POS Pro add-on at 79 € per month, marketplace order overage terms, trial terms and a statement that no setup fees apply. We found no public information on VAT treatment of the listed prices, on monthly-term pricing, on order or revenue limits, or on the cost of the apps most shops need. 2 2

Report an error

European sovereignty — proven facts

1 of 4 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Legal entity	Incorporated in CA ⚠ unverified	0/3 pts	3 Report an error
Ownership	Not determined	—	uncited Report an error
Data residency	Not determined ⚠ unverified	—	uncited Report an error
Subprocessors	Not determined ⚠ unverified	—	uncited Report an error

Where this could be wrong

Evidence ages. The oldest capture behind this page is from 31 Aug 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
Weak sourcing — Legal entity. For EEA, UK and Swiss users the contracting data recipient is the Irish subsidiary Shopify International Ltd., but the policy itself places the company in Canada and no imprint or commercial register is given.
Weak sourcing — Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

106 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
73 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
24 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
19 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
13 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us

Do you know more about Shopify? Tell us Report an error on this page

Sources (13)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

1 Vendor homepage www.shopify.com Checked 5 Oct 2026 +2 earlier captures: 28 Sep 2026, 11 Sep 2026 Details →
2 Pricing www.shopify.com Checked 5 Oct 2026 +4 earlier captures: 28 Sep 2026, 16 Sep 2026, 11 Sep 2026, 31 Aug 2026 Details →
3 Privacy policy www.shopify.com Checked 5 Oct 2026 +1 earlier capture: 16 Sep 2026 Details →
4 Terms of service www.shopify.com Checked 5 Oct 2026 Details →
5 Catalogue & checkout — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
6 Catalogue & checkout — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
7 Tax & German legal correctness — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
8 Tax & German legal correctness — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
9 Extensibility & developer surface — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
10 Extensibility & developer surface — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
11 Order operations & back office — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
12 Order operations & back office — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →
13 Data ownership & exit — found from sitemap www.shopify.com Checked 5 Oct 2026 Details →