Find the weak points in your store before someone else does.
AI helps attackers find weak points faster than ever. Our engineers use the same kind of tools to find yours, show you how to fix each one, and quote the hours to fix it for you.
- Shopify Platinum Partner
- 1,000+ stores supported
- Non-intrusive: we never run attacks
Why now
Attacks got faster. Knowing where you stand is the first defense.
Attackers now use AI to spot gaps faster. That isn’t a reason to panic. It’s a reason to know which doors are open on your store, and close the ones that matter.
1 in 4
malicious breaches were AI-enabled, up 56% in a year.
12.5x
growth in AI-enabled bot attacks in 2025. Bad bots are now 40% of internet traffic.
68%
of retail breaches involved a third party, such as a vendor or partner.
42%
of retail breaches started with an exploited software flaw. Stolen or guessed logins: 14%.
28.65M
keys, tokens and passwords leaked in public code on GitHub in 2025, up 34%.
$96,000
median breach loss in cyber-insurance claims for businesses with $25M to $250M in revenue.
What the audit checks
Eight places weak points hide.
We review from the outside in, and through the access you give us. We never run attacks, load tests or phishing on a live store.
Theme and custom code
Liquid, scripts and custom apps we can read: secrets in code, unsafe inputs, outdated libraries.
Apps and permissions
Every installed app, what it can read and change, and whether it still needs that access.
Integrations and connectors
Your ERP, 3PL, marketing, reviews and other connected services, and the keys they use.
Exposed keys and secrets
API keys, tokens and passwords visible in code, files or anything you share with us.
Staff and admin access
Who can log in and with what rights, including former staff and agencies, and two-step login.
Checkout and payment settings
How payments are set up on your side. We never test payment providers’ own systems.
Email and domain
The SPF, DKIM and DMARC records that stop others sending email as you, and your DNS settings.
Public surface
What anyone can see from outside: exposed files, security headers, old pages and open forms.
What you get
Every finding, who fixes it, the steps and the hours.
Fix them with us, do them yourself, or both. The instructions are yours either way.
| Severity | Finding | Who fixes it | Estimate |
|---|---|---|---|
| Critical | A payment gateway API key pasted into theme code | You revoke it, we remove it | 1.5 hours |
| High | A former agency still has full admin access | You, with our list | About 15 min |
| Medium | An app can change all orders but only needs products | Arctic Grey, with your OK | 1 hour |
| Medium | No DMARC record, so others can send email as you | Arctic Grey | 1 hour |
| Low | Old landing pages and test files are still public | Arctic Grey | 0.5 hours |
- A priority order, so you know what to fix first.
- Step-by-step instructions for every fix, ours or yours.
- A leadership summary on one page, with Advanced.
How it works
Six steps, and you decide at every one.
- Before any test
Authorize
You sign a short authorization listing exactly what we may review, and when. We never touch anything you don’t own or control.
- The review
Audit
Our engineers review your store with AI-assisted tools, then check every finding by hand.
- Your report
Report
Every finding with its severity, who fixes it, the steps and an hour estimate.
- Your call
Fix
You choose what we fix. Each fix draws from your Bulk Hours, at the hours quoted.
- After fixes
Retest
We confirm our fixes worked. The retest is estimated in your quote.
- Every month
Monitor
A regular re-check, because new weak points appear all the time.
Optional
Packages
Start with an audit. Fix what matters.
Every package is Bulk Hours at $220 an hour. Fixes are quoted per finding and draw from your Bulk Hours. Unused hours never expire.
-
Essentials
$1,760 8 Bulk Hours
For a single Shopify store with standard apps.
- All eight areas reviewed
- Every finding with its owner, steps and hours
- A remediation quote in hours
-
Most complete
Advanced
$4,400 20 Bulk Hours
For stores with custom apps, an ERP, headless or several integrations.
- Everything in Essentials
- In-depth review of custom apps and integrations
- A one-page leadership summary
-
Enterprise
Quoted sized on a call
Several stores, custom infrastructure or compliance requirements.
- Scope agreed on a call
- Hours quoted before any work
- The same report and fix quotes
-
Monthly monitoring
About $880 a month, 4 hours
A regular re-check, because new weak points appear all the time.
- A monthly re-scan of the eight areas
- New apps, access and exposed keys reviewed
- A one-page report with new findings and hours
Our honest promise
No one can promise a store that can’t be breached.
New attacks appear every day, and AI keeps making them faster. Anyone who guarantees you’re safe isn’t being straight with you. Here is what we do promise.
- Our best work with today’s tools and knowledge.
- Plain answers about every weak point we find.
- The fix and the hours for each one, so you decide.
- We never test anything you don’t own or haven’t authorized.
- Your report stays confidential, and we delete raw scan data 90 days after delivery.
Questions
What people ask before they start.
Anything else, ask on a 15-minute call.
Can you guarantee my store won’t be hacked?
No, and no one honestly can. New attacks appear every day. We find and fix the weak points we can see with today’s tools, and tell you plainly about the rest. Security work is billed by the hour, with no guarantee of results.
Will the audit slow down or break my store?
No. The audit is non-intrusive: we review your code, settings and access, and check your public site from the outside. We don’t run attacks, load tests or phishing.
Do you test Shopify itself, or my apps’ servers?
No. We never test Shopify’s platform or another company’s systems without that company’s written permission. We review how apps are set up in your store and what they can access.
What if you find card numbers, keys or customer data?
We stop, tell your contact within one business day (the same business day for critical items), and never copy the data. We note where it is and redact it in the report. You revoke or replace what was exposed and make any notifications the law requires, and we can help with the technical side.
Do I have to use you for the fixes?
No. Every finding comes with step-by-step instructions. Use us, your own team, or both.
How is it priced?
By the hour, as Bulk Hours at $220 an hour: 8 hours for Essentials, 20 for Advanced, and Enterprise is quoted. If your audit takes fewer hours than the package, the rest stays in your balance. If it needs more, we tell you and quote before going over. Fixes are quoted per finding in hours. Unused hours never expire.
We think we’re being attacked right now. Can you help?
Contact Shopify and your payment providers first. We’ll help as fast as we can during business hours, billed hourly. We don’t offer 24/7 response or guaranteed response times.
Do you use AI on our code?
Yes, with safeguards. We remove secrets and personal data before any AI tool sees our findings, we use only business AI accounts that don’t train on your data, and an engineer checks every finding.
Who sees the report?
You do. Your report is confidential. We delete raw scan data and logs 90 days after we deliver it, and with your written OK we may privately tell an app’s maker about a weakness in their app.
Do you need our passwords?
No shared passwords by email. You give us access through Shopify collaborator or staff accounts scoped to the work, and you remove it when we’re done.
Know where you stand.
Start with an audit. You get every weak point, the fix and the hours.