Vendor security reviews · Commerce & industry
Vendor Security Review & Questionnaire Support for E-commerce & DTC Brands
A vendor security review tells you which app in your Shopify admin, which SMS platform and which 3PL actually deserve the data access they hold, before an install becomes a breach headline with your brand's name on it. Brands call for this before adding a new checkout script, after a marketing-vendor breach makes the news, or when an acquirer's PCI letter asks who else touches customer data. We inventory what's already installed, tier it by risk, and tell you which vendors need a SOC 2 report and which only need a signed data-processing agreement.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
The vendor categories that actually touch customer data
A typical brand's vendor list is longer than anyone realizes until it's written down. Each category below carries a different level of access and a different question to ask.
Storefront apps and their scopes
Installed Shopify or platform apps that request read or write access to orders, customers and payment details, often far beyond what their stated function needs.
Marketing and messaging platforms
Klaviyo, Attentive, Postscript and similar tools holding email addresses, SMS numbers and consent records, plus the ad platforms receiving hashed identifiers through CAPI.
Fraud, reviews and loyalty tools
Signifyd, NoFraud, Yotpo, Okendo and Smile.io-class vendors, each storing order or identity signals that make them worth vetting even though they sit outside the checkout itself.
3PL, WMS and customs brokers
Fulfilment partners and customs brokers holding shipping addresses, order contents and sometimes ID documents for regulated or age-gated goods, often on systems your team never logs into directly.
CX and support platforms
Gorgias or Zendesk instances storing tickets, photos and identity documents submitted for returns, warranty claims or age verification.
Regulatory map
Why vendor vetting is a legal duty, not a courtesy
Because almost every system in a DTC stack belongs to someone else, Canadian privacy law puts real weight on how carefully you chose and monitor that someone else.
PIPEDA accountability for what vendors do
The organization that collected the data stays accountable for it even after a vendor processes it, which means a contract and a review are how you demonstrate that accountability, not an afterthought.
Law 25's cross-border assessment duty
Sending a Quebec customer's data to a US-hosted vendor requires a privacy impact assessment before the transfer, a requirement that touches nearly every app on a typical storefront.
PCI's expectations for the payment page
Since the SAQ A eligibility change, a merchant must be able to account for every script running on checkout, which means any new tag or app added there needs sign-off, not silent installation by whoever finds it useful.
The platform's own boundary
Shopify documents its Level 1 PCI certification while noting merchants carry responsibilities of their own, exactly the line a vendor review has to draw for every app installed inside that admin.
What goes wrong
What an unreviewed vendor list actually costs a brand
These aren't hypothetical risks. Vendors and installed tools have been the entry point for some of the largest incidents Canadian retail has reported.
A messaging vendor's breach becomes your story
Giant Tiger's customer-communications vendor was compromised, and millions of customer records later leaked publicly with the retailer's name attached, not the vendor's.
An over-scoped app with a wide-open door
An app granted full order and customer read access for a narrow function multiplies your exposure the moment that app or its developer account is compromised, with no way to contain the damage afterward.
A skimmer script disguised as a legitimate tag
The compromise behind the LCBO's storefront ran through a script posing as a routine tag-manager component, exactly the kind of vendor-adjacent addition a review is built to catch before it ever goes live.
A 3PL or customs broker with no visible security posture
Fulfilment partners rarely publish a SOC 2 report, and without a questionnaire or contract terms in place you have no way to know how shipping and identity data are actually handled downstream.
Insider access at the platform layer
Two Shopify support staff were found pulling merchant order data in 2020, a reminder that even a certified platform's own personnel represent an access path worth understanding, not assuming away.
Our vendor security reviews for e-commerce & dtc brands
What the review delivers for your vendor list
The engagement is built to fit a lean team: a clear inventory, a tiered risk view and language you can actually put in a contract.
Full vendor inventory
A list built from your Shopify app list, marketing platform admin panels, payment and fraud tools, and vendor invoices, since most brands have more installed access than anyone remembers granting.
Risk tiering by data and function
Vendors ranked by what they touch, payment-adjacent, customer identity, marketing consent, or low-stakes, so review effort goes where the exposure actually sits.
SOC 2 versus DPA determination
A clear call on which vendors' existing SOC 2 or ISO reports are sufficient evidence and which instead need a signed data-processing agreement with specific security and breach-notice terms.
Contract and scope recommendations
Practical language for breach notification, data location, retention and app-permission scope to bring back to the vendor or build into your next renewal.
A pre-install review checklist
A short, repeatable checklist your team runs before installing the next app or signing the next marketing vendor, so review happens before go-live rather than after an incident.
How the engagement runs
How the review runs without slowing your team down
Vendor reviews are scheduled to fit around, not compete with, the calendar that actually governs an online store.
Step 1
Build the vendor inventory
We pull your installed app list, marketing and fraud platform admin panels, and vendor contracts to build one complete picture.
Step 2
Tier and prioritize
Vendors are sorted by data sensitivity and access level so the deepest review lands on payment-adjacent and identity-holding tools first.
Step 3
Send questionnaires and assess evidence
Priority vendors receive structured questions, and their SOC 2, ISO or published security claims are checked against what your review actually needs to know.
Step 4
Deliver findings and a pre-install checklist
You get a plain-language report, contract recommendations, and a lightweight process for vetting the next app before the freeze locks your storefront.
What it costs
What determines the cost of a vendor review here
Price follows the size of the vendor list and how deep each review needs to go: how many storefront apps, marketing platforms, fraud tools and fulfilment partners are in play, how many already publish a SOC 2 or ISO report versus needing a full questionnaire, and whether contract renegotiation support is included.
A single-brand store with a handful of core apps is a modest engagement; a multi-brand operation with several 3PLs, an agency roster and a custom app portfolio is larger. Vendor review is also part of the ongoing Virtual Privacy Office retainer, which starts at $2,200 CAD per month, for brands that want it running continuously rather than as a one-time project.
E-commerce & DTC Brands: Vendor security reviews questions, answered
Start with what the app actually needs. Check the permission scopes it requests against its stated function, look for a SOC 2 report, ISO certification or published security page, and confirm a data-processing agreement covers breach notice and data location. For an SMS or email vendor, also check how it stores consent records and whether its list-import controls could let bad data in. A short pre-install checklist turns this into a five-minute step before anyone clicks install.
Ask where the data physically sits, who at the 3PL can access shipping and order records, how long they retain them after fulfilment, and what happens to any ID documents collected for regulated or age-gated goods. Few fulfilment partners publish a SOC 2 report, so a structured questionnaire and specific contract terms, breach-notice timelines, retention limits, subcontractor disclosure, usually do more work than asking for a certification that doesn't exist.
Reserve the SOC 2 expectation for vendors handling payment-adjacent or high-volume customer data continuously, major ESPs, CDPs and platform-level tools, where an independent audit report is realistic to obtain. Smaller or narrower-function vendors, a niche app or a regional 3PL, rarely have one, and a signed data-processing agreement with clear security and breach-notice terms is the practical substitute. The review tells you which category each vendor falls into.
Both, on different schedules. New vendors get a pre-install check before they touch live data; existing ones drift, an app that expanded its scope in an update, a 3PL that changed subcontractors, a marketing platform that added a new integration, so an annual pass through the full inventory catches what changed since the last look. Brands that only review at signup consistently miss the risk that shows up eighteen months later.
No, and Shopify's own security page says as much: the platform is certified Level 1 PCI DSS compliant for its infrastructure, but merchants have steps of their own to take. Every app installed inside your admin operates under your authorization, not the platform's certification, which is exactly why the new SAQ A criteria ask merchants to account for the scripts and integrations running on their own storefront.
Directly. Your SAQ answers depend on knowing which scripts and apps touch the payment page, and the vendor inventory is where that evidence comes from. A review completed before attestation is due gives your CFO a documented answer instead of a guess about what's actually running on checkout.
More for e-commerce & dtc brands
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.