Foundation · 2 min
What you need to know
What is the shared-responsibility model in ecommerce?
The shared-responsibility model divides security work among the platform, merchant, and other providers. Each party protects the layers and decisions it controls, with documented handoffs between them.
What security does an ecommerce platform manage?
A platform may manage hosting, core software, infrastructure patches, service availability and built-in security controls. Confirm the exact scope in current contracts and technical documentation.
What security remains the merchant’s responsibility?
The merchant commonly manages staff accounts, roles, MFA adoption, connected apps, customer-data use, exports, endpoint safety, policy choices, and response coordination.
Who is responsible for employee account security?
The merchant is responsible for creating, protecting, reviewing and removing employee access, while the platform must provide and protect the account-control mechanism it promises.
Who is responsible for installed apps and integrations?
The merchant chooses and configures integrations and must review permissions and use; the platform and app publisher protect their own services. A contract does not replace merchant oversight.
Who is responsible for customer-data handling?
The merchant decides why customer data is collected and how its staff and providers use it, subject to applicable rules. Platforms and processors have their own contractual and security duties.
A quick store check
Create a responsibility table for platform, merchant and provider duties and assign a named owner to every merchant-controlled task.
Foundation · 2 min
Frequently asked questions
Should the merchant copy the platform’s security policy?
No. The merchant needs a policy for the accounts, apps, devices and data practices it controls.
Who owns a security task when a contract is unclear?
Escalate and document the gap; do not assume another party is performing work that protects customers.