Snapshot 256147
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security Notice: Regarding Third-Party Gorgias Applications Start your security review View & download sensitive information Ask for information Overview Welcome to Commerce.com's Trust Center. At Commerce.com, security, privacy, resilience, and responsible AI development are foundational to our platform. We are committed to delivering a secure, reliable, and trustworthy e-commerce experience for you and your customers. What Sets Us Apart Best-in-Class Payment Security BigCommerce maintains Level 1 PCI DSS Attestations of Compliance as both a Merchant and a Service Provider—the highest level available. This simplifies your compliance and demonstrates our commitment to protecting payment data. Proactive Threat Defense We partner with Recorded Future and collaborate with security communities like RH-ISAC, InfraGard, and CISA to monitor and respond to evolving threats before they impact your business. Proven Compliance Frameworks Our security program is aligned with the NIST Cybersecurity Framework and certified against globally recognized standards, including ISO/IEC 27001:2022, 27017, 27018, 27701, and 22301, ensuring rigorous risk and continuity management. Purpose-Built for Enterprise E-commerce Unlike general-purpose platforms that can hold you back, BigCommerce empowers you with the scalability, control, and advanced security features needed to thrive in the complex world of enterprise e-commerce. Responsible AI, Certified Under ISO/IEC 42001 BigCommerce is among the first to certify against ISO/IEC 42001:2023, the international AI management system standard. Our use of AI—for fraud prevention, recommendations, and personalization—is governed by principles of transparency, safety, and accountability. Built for Enterprise E-commerce We’re purpose-built for the complexity of enterprise retail, providing the scale, control, and advanced security features global businesses demand. Security You Can Manage We provide the tools to help you manage your store’s privacy and security. You stay in control—while we ensure the platform beneath you stays trusted. Stay Informed Subscribe to this Trust Center for the latest security updates and compliance resources. Contact Us Privacy: privacy@bigcommerce.com Security: security@bigcommerce.com Sales & Support: https://www.bigcommerce.com/contact Compliance PCI DSS v4.0.0 GDPR EU-US DPF Privacy Shield CCPA CPRA SOC 1 SOC 2 SOC 3 ISO/IEC 27001:2022 ISO/IEC 27001 SoA ISO 9001:2015 ISO/IEC 42001:2023 ISO 22301 ISO/IEC 27701 ISO/IEC 27017:2015 ISO/IEC 27018:2019 TX-RAMP FIPS 140-2 CSA STAR RH-ISAC CISA: Secure-by-Design Pledge Visa Service Provider ProcessUnity NIST 800-53 Rev. 5 NIST CSF WCAG Commerce is reviewed and trusted by Green Roads | Deerfield Beach FL Yeti Cycles i9 Sports Bealls Stores SOLETRADER Bensons for Beds Coldwater Creek Diamonds Direct King Arthur Baking Harvey Nichols Liberty Coin Ollie One Kings Lane Dr. Barbara Sturm Andertons Music Co. The Fold London United Aqua Group UPLIFT Desk Vodafone Group Documents Featured Documents DOCUMENTSBusiness Continuity Management Program DOCUMENTSCIO & CISO Whitepaper- New! REPORTSNetwork Diagram REPORTSPentest Report REPORTSVulnerability Assessment Report COMPLIANCEPCI DSS v4.0.0 DATA PRIVACYData Protection & Transfer Impact Summary POLICIESInformation Security Policy Awards/Recognition 2023 Gartner Magic Quadrant 2023 INC. Power Partner 2023 MACH Impact Award View more Product Security Audit Logging Data Security Integrations View more Reports Analyst Recognition Network Diagram Other Reports View more Self-Assessments CAIQ Other Self-Assessments Data Security Access Monitoring Data Backups Data Erasure View more App Security Responsible Disclosure Application Penetration Testing Code Analysis View more AI & Quality AI Governance Quality Policy Legal Subprocessors Cyber Insurance Data Processing Agreement View more Data Privacy Data Protection & Transfer Impact Summary Data Protection Officer (DPO) International Data Transfer Whitepaper View more Access Control Data Access Logging Infrastructure Google Cloud Platform Infrastructure Security Separate Production Environment Endpoint Security DNS Filtering Endpoint Detection & Response Mobile Device Management View more Network Security Firewall IDS/IPS Network Penetration Testing View more Corporate Security Email Protection Employee Training Incident Response View more Policies Acceptable Use Policy Access Control Policy Business Continuity/Disaster Recovery (BC/DR) Policy View more Security Grades Qualys SSL Labs login.bigcommerce.com A+ Knowledge Base (FAQ) Is system identity information and levels of access managed, stored, and reviewed? Is a process established and followed to review and take appropriate and timely actions on detected anomalies? Are requirements for non-disclosure/confidentiality agreements reflecting organizational data protection needs and operational details identified, documented, and reviewed at planned intervals? Is the ability to disable the "read-only" configuration of logging infrastructure controlled through a procedure that ensures the segregation of duties and break glass procedures? Is the deployment and integration of application code automated where possible? View more Commerce Trust Center Updates Security Notice: Regarding Third-Party Gorgias Applications Incidents On November 10, 2026, Commerce was notified by third-party application provider Gorgias of a security incident involving their systems. At Gorgias’s request, Commerce uninstalled the Gorgias app from your store as a precaution to revoke its existing access token,we are notifying you of this action. The potential impact identified in relation to BigCommerce concerns Gorgias app credentials and merchant store access tokens held in Gorgias’s environment. There is no known impact or compromise of Commerce’s systems or platform. How This Affects You Removing the app revoked existing access tokens for your store and disconnected the integration. This action removed access via credentials which were present in Gorgias’s compromised systems, but may interrupt customer support workflows and other services you use through the Gorgias BigCommerce integration until you reconnect. Gorgias is notifying merchants whose support data was accessed. Removal of the app does not indicate that your store’s information was accessed. You are urged to refer to Gorgias’s direct communications for details specific to your account because Commerce has limited visibility into this third- party compromise. Questions regarding accessed data should be directed to Gorgias. What You Should Do Contact Gorgias about your store’s potential exposure. Review Gorgias’s direct communications and contact support@gorgias.com or your Gorgias account manager for account-specific findings and any additional steps. Review your store activity. Investigate unexpected access or changes and work with Gorgias to establish the relevant period for investigation. Where support data was accessed through Gorgias’s systems, consider the potential for phishing or social engineering using exposed contact details or conversation contents. Work with Gorgias to restore the integration. Follow Gorgias’s instructions to reinstall the app and reconnect your BigCommerce store so the integration uses a newly issued access token. Before reconnecting, assess whether the integration meets your security, privacy, compliance, and operational requirements. Assess any notification obligations. Consult your legal, privacy, or compliance advisers to determine whether further investigation or notification is appropriate based on Gorgias’s account-specific findings and your circumstances. Commerce can assist with questions about the app’s removal and available BigCommerce platform logs. Questions about Gorgias’s root cause, investigation, or the information involved should be directed to Gorgias. Security Notice: 'PHP2Shell' Critical Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Vulnerabilities On October 23, PHP disclosed an additional vulnerability, CVE-2026-115560, affecting applications with a specific, uncommon configuration. Following our security team’s assessment, we have determined that Commerce systems are not impacted by this vulnerability. Commerce will continue to monitor developments and evaluate any additional guidance or security updates as they become available. You can read more here: https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/ Commerce has applied emergency patches across all services to address the critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We have found no evidence of exploitation affecting Commerce systems or customer data. Our security team continues to monitor our environment. All affected Commerce services have been patched or are protected by established, industry-standard mitigation measures designed to reduce exposure to these vulnerabilities. These measures form part of Commerce's coordinated security response, alongside the deployment of available security updates and ongoing validation of protective controls. All Commerce products, including BigCommerce, Feedonomics, and Makeswift, remain secure and protected against these vulnerabilities. The Commerce security and engineering team has identified no evidence of compromise or attempted exploitation against Commerce systems, and no evidence that customer data has been compromised. Enhanced monitoring and continuous review of security logs remain in place. Commerce will publish further updates through the Security Trust Center if the assessment changes or additional customer action is required. Commerce is aware of two industry-wide critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP released emergency patches on October 21, 2026, and cybersecurity agencies worldwide have urged organizations to update immediately or take affected systems offline. This is an industry-wide issue affecting any system running vulnerable versions of PHP. It is not the result of a compromise of Commerce systems. We are taking immediate action to notify our customers and patch our use cases immediately. What we’re doing: Commerce is working with our partners and internal engineering team and immediately began patching as soon as fixes became available. We continue to monitor our systems for exploits. As of today, we have found no evidence that this issue was exploited against Commerce systems or customer data. We will update this advisory if our assessment changes. We are also notifying our customer base as there may be custom PHP solutions customers need to address. What you need to do: If you run your own PHP applications, please review any custom PHP solutions, check your third-party integrations for exposure, and apply the PHP patches as soon as possible. If you don’t run custom PHP applications, no action is needed on your part at this time. For further information and live updates: For the latest information as this situation develops, please check the Commerce Security Trust Center https://security.bigcommerce.com/. We will post updates there as soon as they are available. Monitor the PHP advisory: https://www.php.net/index.php#2026-10-21-5 Read more here: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ Questions: Please contact Commerce Support if you have any questions or observe any issues. Security Notice Regarding Third-Party Fastr Applications Incidents On September 17, 2026, Commerce confirmed that API credentials belonging to third-party application developer “Be A Part Of,” a Fastr company, had been compromised as a result of a Fastr system compromise. This was not a breach of Commerce systems or the BigCommerce platform. The only way to be affected by this incident is for the merchant to have independently installed a Fastr developed application. Commerce has limited visibility into whether the actions taken by the application are valid or the result of the malicious actor. You should reach out of Fastr at support@getfastr.com for more information. Security Advisory: React Server Components CVE-2026-23864 Vulnerabilities We are aware of the recently disclosed React Server Components vulnerability, CVE-2026-23864 (CVSS 7.5), which affects certain versions of React Server Components used by frameworks such as Next.js. Commerce.com is not affected by this vulnerability. We have not identified any impact to our platform or customer environments. The vulnerability relates to denial-of-service scenarios triggered by specially crafted HTTP requests to React Server Component server functions. Importantly, this issue does not allow for remote code execution. We recommend that customers who independently use React Server Components in their own applications review the advisory and upgrade to a patched version if applicable. More information: https://vercel.com/changelog/summary-of-cve-2026-23864 Patched versions are available for affected React and framework releases, and users should upgrade as recommended by their framework maintainers. A critical severity vulnerability related to React Server Components has been disclosed affecting React versions 19.0, 19.1, and 19.2. Vulnerabilities A critical severity vulnerability related to React Server Components has been disclosed affecting React versions 19.0, 19.1, and 19.2. This includes Next.js which is used for internal applications at Commerce as well as customers building storefronts using Catalyst and Makeswift. For further details on the vulnerability, refer to Critical Security Vulnerability in React Server Components. https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components To avoid exposure, Next.js and React need to be updated to their latest patched versions. If you’re hosting your application on Vercel or are using Cloudflare’s WAF, those providers have platform level protections that help mitigate this vulnerability. However, upgrading to the latest versions of Next.js and React is strongly recommended. For further details refer to the Vercel (https://vercel.com/changelog/cve-2025-55182) and Cloudflare (https://blog.cloudflare.com/waf-rules-react-vulnerability/) blog posts. Here’s what else you need to know specific to Commerce. Actions we are taking All affected Next.js applications at Commerce have been upgraded to a patched version of Next.js, addressing the vulnerability. We’ve also released Catalyst v1.3.5 which ships with a patched version of Next.js. Actions you need to take If you are running a Catalyst-based headless storefront, you will need to update it to a version that includes the patched releases of Next.js and React. The following Catalyst versions incorporate these fixes. @bigcommerce/catalyst-core@1.3.5 @bigcommerce/catalyst-makeswift@1.3.6 For migration details, refer to the Catalyst 1.3.5 Release Notes. If you’re using a version of @bigcommerce/catalyst-b2b-buyer-portal, follow the manual steps outlined in the release notes. https://developer.bigcommerce.com/docs/storefront/catalyst/release-notes/1-3-5 Makeswift Makeswift customers that are not using Catalyst should follow the Makeswift blog post for specific mitigation steps. https://www.makeswift.com/blog/announcements/2025-12-03-react-server-components-vulnerability If you think you may have discovered a vulnerability, please send us a note. Report issue