Shopify Subprocessors List (October 2026): Changes and History
Shopify names 34 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Last checked October 1, 2026
Official source ↗
Shopify subprocessors (October 2026)
| # | Subprocessor | Purpose | Location | Data |
|---|---|---|---|---|
| 1 | Shopify Inc. | Providing the Shopify platform and other related services to Shopify International Limited and to Shopify Commerce Singapore Pte. Ltd. | Canada | Merchant customer personal data as needed to provide platform functionality and merchant services pursuant to commercial and applicable intercompany agreements |
| 2 | Shopify International Limited | Providing services to Shopify Inc. and to Shopify Commerce Singapore Pte. Ltd. related to the Shopify platform | Ireland | Merchant customer personal data as needed to provide platform functionality and merchant services pursuant to commercial and applicable intercompany agreements |
| 3 | Shopify Commerce Singapore Pte. Ltd. | Providing services to Shopify Inc. and to Shopify International Limited related to the Shopify platform | Singapore | Merchant customer personal data as needed to provide platform functionality and merchant services pursuant to commercial and applicable intercompany agreements |
| 4 | Shopify Global Inc. | Providing services to Shopify Inc., Shopify International Limited and Shopify Commerce Singapore Pte. Ltd related to the Shopify platform | United States | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 5 | Shopify Payments (USA) Inc. | Providing services to Shopify Inc. related to the Shopify platform | United States | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 6 | Shopify Capital Inc. | Providing services to Shopify Inc. related to the Shopify platform | United States | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 7 | Shopify (USA) Inc. | Providing services to Shopify Inc. related to the Shopify platform | United States | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 8 | Shopify Commerce France, SAS | Providing services to Shopify International Limited related to the Shopify platform | France | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 9 | Shopify Commerce Germany GmbH | Providing services to Shopify International Limited related to the Shopify platform | Germany | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 10 | Shopify Commerce Italy S.r.l. | Providing services to Shopify International Limited related to the Shopify platform | Italy | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 11 | Shopify Lithuania UAB | Providing services to Shopify International Limited related to the Shopify platform | Lithuania | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 12 | Shopify Commerce Netherlands B.V. | Providing services to Shopify International Limited related to the Shopify platform | Netherlands | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 13 | Shopify Commerce Poland Sp. z.o.o. | Providing services to Shopify International Limited related to the Shopify platform | Poland | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 14 | Shopify Commerce Spain, S.L. | Providing services to Shopify International Limited related to the Shopify platform | Spain | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 15 | Shopify Sweden AB | Providing services to Shopify International Limited related to the Shopify platform | Sweden | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 16 | Shopify UK Limited | Providing services to Shopify International Limited related to the Shopify platform | United Kingdom | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 17 | Shopify (Australia) Pty Ltd. | Providing services to Shopify Commerce Singapore Pte. Ltd. related to the Shopify platform | Australia | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 18 | Shopify Commerce India Private Limited | Providing services to Shopify Commerce Singapore Pte. Ltd. related to the Shopify platform | India | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 19 | Shopify Japan Kabushiki Kaisha | Providing services to Shopify Commerce Singapore Pte. Ltd. related to the Shopify platform | Japan | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 20 | Shopify Commerce New Zealand Limited | Providing services to Shopify Commerce Singapore Pte. Ltd. related to the Shopify platform | New Zealand | Merchant customer personal data as needed to perform the services pursuant to applicable intercompany agreements |
| 21 | Adyen N.V. | Supporting payment functionality | Netherlands | Personal data as necessary to provide Shopify Payments functionality |
| 22 | Amazon Web Services, Inc. | Cloud hosting | USA | All platform data |
| 23 | Anthropic PBC | Conversational artificial intelligence services | USA | Personal data if input to or included in a response by Shopify Sidekick |
| 24 | Applied Compute Inc. | Conversational artificial intelligence services | USA | Personal data if input to or included in a response by Shopify Sidekick |
| 25 | Cloudflare, Inc. | Load balancing and DDoS protection | USA | All platform data |
| 26 | Fireworks.ai, Inc. | Conversational artificial intelligence services | USA | Personal data if input to or included in a response by Shopify Sidekick |
| 27 | Google Cloud Canada Corporation | Cloud hosting and data processing | Canada | All platform data |
| 28 | Groq, Inc. | Artificial intelligence services | USA | All platform data |
| 29 | Mailgun Technologies, Inc. | Email and SMS transmission | USA | Personal data as necessary to provide messaging functionality |
| 30 | Microsoft Corporation | Conversational artificial intelligence services | USA | Personal data if input to or included in a response by Shopify Sidekick |
| 31 | Nebius B.V. | Optimizing computational workloads and hosting technical environments | Netherlands | All platform data |
| 32 | OpenAI, L.L.C. | Conversational artificial intelligence services | USA | Personal data if input to or included in a response by Shopify Sidekick |
| 33 | Stripe, LLC; Stripe Payments Europe, Ltd. | Supporting payment functionality | USA, Ireland | Personal data as necessary to provide Shopify Payments functionality |
| 34 | Twilio Inc. | Email and SMS transmission | USA | Personal data as necessary to provide messaging functionality |
Get an email when Shopify changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
Key DPA terms at Shopify
What Shopify's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Without undue delay, with no set deadline
“Shopify shall provide You with notice, without undue delay, upon becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Your Customer Personal Data transmitted, stored or otherwise processed.”
DPA, www.shopify.com ↗ - Transfers outside the EU
-
Standard contractual clauses, binding corporate rules, and adequacy decisions
“Where such transfers are made from the EEA and/or Switzerland to another Shopify entity outside the EEA or Switzerland they will be done in accordance with Shopify's Binding Corporate Rules (BCRs).”
“the relevant modules under the 2021 Standard Contractual Clauses approved by the European Commission in its decision 2021/914/EC dated June 4, 2021;”
“where necessary may also rely on the European Commission's adequacy decision in relation to Canada to support International Transfers from Shopify International Limited to its Canadian-registered corporate parent Shopify Inc.”
DPA, www.shopify.com ↗ - Customer data after the contract ends
-
Deleted or returned when the contract ends
“Following termination, Shopify will, at Your choice, delete or return Your Customer Personal Data.”
DPA, www.shopify.com ↗ - Audit rights
-
Through certifications and audit reports only
“Shopify may fulfill Your right of audit under European Data Protection Laws in relation to the processing of Your Customer Personal Data by providing You - upon Your written request and subject to confidentiality - with: (i) Shopify's most recent audit report results, either from Shopify's self-audits or prepared by an independent third party auditor;”
DPA, www.shopify.com ↗
Documents we track for Shopify
- DPA
- checked September 30, 2026 www.shopify.com ↗
- Privacy policy
- checked September 30, 2026 www.shopify.com ↗
- Subprocessor list
- checked October 1, 2026 help.shopify.com ↗
- Terms of service
- checked September 30, 2026 www.shopify.com ↗
Change history
Tracking since October 1, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
Shopify subprocessors FAQ
- How many subprocessors does Shopify use?
- Shopify lists 34 subprocessors on its published list, including Shopify Inc., Shopify International Limited, Shopify Commerce Singapore Pte. Ltd., Shopify Global Inc., and Shopify Payments (USA) Inc. and 29 more.
- Where does Shopify process customer data?
- The subprocessors named by Shopify are located in USA, United States, Netherlands, Canada, Ireland, and Australia and 12 other locations, as stated on its list.
- How quickly does Shopify report a personal data breach to customers?
- According to its DPA, Shopify reports a personal data breach to customers without undue delay, with no set deadline: “Shopify shall provide You with notice, without undue delay, upon becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Your Customer Personal Data transmitted, stored or otherwise processed.”
- How does Shopify transfer personal data outside the EU?
- Shopify's DPA relies on standard contractual clauses, binding corporate rules, and adequacy decisions: “Where such transfers are made from the EEA and/or Switzerland to another Shopify entity outside the EEA or Switzerland they will be done in accordance with Shopify's Binding Corporate Rules (BCRs).”
- When was Shopify's subprocessor list last checked?
- ClauseTrail last checked Shopify's subprocessor list on October 1, 2026. Lists are re-checked daily.
- How do I find out when Shopify adds or removes a subprocessor?
- ClauseTrail monitors Shopify's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.