Summary
Onward is not affected by the PHP vulnerabilities disclosed on October 21, 2026. Onward's production systems do not run PHP, Node.js, or Go, so no patch or mitigation was required. Our review found no evidence of unauthorized access to Onward systems or to any store's data, and no action is needed on your side — you do not need to rotate credentials, review theme files, or disable or reinstall the app.
The sections below answer the questions merchants most often ask in security reviews or vendor questionnaires about this disclosure.
What data Onward stores
For stores using Onward, we process and store:
Order data — order number, line items, totals, shipping address, and fulfillment and tracking details
Customer contact details needed to deliver Checkout+, Returns, and tracking — name, email, phone, and shipping address
Shopify access tokens — short-lived, automatically rotated, and encrypted at rest
Onward does not store payment card data. Merchant billing is handled by Stripe; Onward keeps only a Stripe customer or charge reference and the card's last four digits.
Data is encrypted at rest and in transit (TLS).
Technology and patching
None of Onward's production systems run PHP, Node.js, or Go. The October 21 PHP disclosure does not apply to our platform, so no patch or mitigation was required or deployed in relation to it.
Certificates (eMudhra)
Onward's systems are protected by Cloudflare, which mitigates the reported eMudhra intermediate certificate issue for our traffic. Onward does not explicitly trust or pin the affected intermediate certificates.
Investigation
A senior internal engineer reviewed Onward's application, infrastructure, and access logs for the period from October 1, 2026 onward and found no evidence of unauthorized access or exploitation.
Was my store's data accessed? No. No data from any store using Onward was accessed, copied, or changed without authorization since October 1, 2026, based on the review above.
Storefront and checkout
Onward integrates with your store through Shopify's standard theme app embed and secure checkout extension APIs. Onward does not modify your theme files. Our scripts are served only from Onward's infrastructure, and every change goes through code review and our deployment pipeline.
Credentials and recommended actions
Onward uses Shopify's short-lived, automatically rotated access credentials, so no manual token rotation was required.
Action | Needed? |
Rotate Shopify credentials or API keys | No |
Review theme files | No — Onward does not edit theme files |
Disable or reinstall the Onward app | No |
Contact your customers | No |
Customer contact and notification
Onward will not contact your customers, or any brand you support, about this matter without coordinating with you first, consistent with Shopify's Partner Program Agreement and API Terms.
If we later find that data from your store was accessed, we will notify you within 72 hours. We are preserving relevant logs from October 1, 2026.
Security and compliance at Onward
Onward is SOC 2 compliant. The Onward Trust Center (hosted by Vanta) lists our compliance status and the security controls in place, including:
Area | Example controls |
Infrastructure security | Production database, network, and OS access restricted to authorized users with a business need; MFA required for remote access to production systems; restricted access to encryption keys and the firewall |
Product security | Sensitive customer data encrypted at rest; penetration testing performed at least annually; vulnerability management and system monitoring procedures |
Organizational security | Employee background checks; confidentiality agreements for employees and contractors; anti-malware and mobile device management on company devices |
Internal security procedures | Business continuity and disaster recovery plans, tested at least annually; formal software development lifecycle; cybersecurity insurance |
Data and privacy | Data retention and classification policies; customer data removed when a merchant leaves the service |
Infrastructure and product security details are in the Infrastructure security and Product security sections of the Trust Center.
Still have questions?
If your security team needs answers beyond this page — for example, to complete a vendor questionnaire — contact us at [email protected].