Snapshot 8350
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Security Notice Regarding Third-Party Fastr Applications Start your security review View & download sensitive information Ask for information Overview Welcome to Commerce.com's Trust Center. At Commerce.com, security, privacy, resilience, and responsible AI development are foundational to our platform. We are committed to delivering a secure, reliable, and trustworthy e-commerce experience for you and your customers. What Sets Us Apart Best-in-Class Payment Security BigCommerce maintains Level 1 PCI DSS Attestations of Compliance as both a Merchant and a Service Provider—the highest level available. This simplifies your compliance and demonstrates our commitment to protecting payment data. Proactive Threat Defense We partner with Recorded Future and collaborate with security communities like RH-ISAC, InfraGard, and CISA to monitor and respond to evolving threats before they impact your business. Proven Compliance Frameworks Our security program is aligned with the NIST Cybersecurity Framework and certified against globally recognized standards, including ISO/IEC 27001:2022, 27017, 27018, 27701, and 22301, ensuring rigorous risk and continuity management. Purpose-Built for Enterprise E-commerce Unlike general-purpose platforms that can hold you back, BigCommerce empowers you with the scalability, control, and advanced security features needed to thrive in the complex world of enterprise e-commerce. Responsible AI, Certified Under ISO/IEC 42001 BigCommerce is among the first to certify against ISO/IEC 42001:2023, the international AI management system standard. Our use of AI—for fraud prevention, recommendations, and personalization—is governed by principles of transparency, safety, and accountability. Built for Enterprise E-commerce We’re purpose-built for the complexity of enterprise retail, providing the scale, control, and advanced security features global businesses demand. Security You Can Manage We provide the tools to help you manage your store’s privacy and security. You stay in control—while we ensure the platform beneath you stays trusted. Stay Informed Subscribe to this Trust Center for the latest security updates and compliance resources. Contact Us Privacy: privacy@bigcommerce.com Security: security@bigcommerce.com Sales & Support: https://www.bigcommerce.com/contact Compliance PCI DSS v4.0.0 GDPR EU-US DPF Privacy Shield CCPA CPRA SOC 1 SOC 2 SOC 3 ISO/IEC 27001:2022 ISO/IEC 27001 SoA ISO 9001:2015 ISO/IEC 42001:2023 ISO 22301 ISO/IEC 27701 ISO/IEC 27017:2015 ISO/IEC 27018:2019 TX-RAMP FIPS 140-2 CSA STAR RH-ISAC CISA: Secure-by-Design Pledge Visa Service Provider ProcessUnity NIST 800-53 Rev. 5 NIST CSF WCAG Commerce is reviewed and trusted by Green Roads | Deerfield Beach FL Yeti Cycles i9 Sports Bealls Stores SOLETRADER Bensons for Beds Coldwater Creek Diamonds Direct King Arthur Baking Harvey Nichols Liberty Coin Ollie One Kings Lane Dr. Barbara Sturm Andertons Music Co. The Fold London United Aqua Group UPLIFT Desk Vodafone Group Documents Featured Documents DOCUMENTSBusiness Continuity Management Program DOCUMENTSCIO & CISO Whitepaper- New! REPORTSNetwork Diagram REPORTSPentest Report REPORTSVulnerability Assessment Report COMPLIANCEPCI DSS v4.0.0 DATA PRIVACYData Protection & Transfer Impact Summary POLICIESInformation Security Policy Awards/Recognition 2023 Gartner Magic Quadrant 2023 INC. Power Partner 2023 MACH Impact Award View more Product Security Audit Logging Data Security Integrations View more Reports Analyst Recognition Network Diagram Other Reports View more Self-Assessments CAIQ Other Self-Assessments Data Security Access Monitoring Data Backups Data Erasure View more App Security Responsible Disclosure Application Penetration Testing Code Analysis View more AI & Quality AI Governance Quality Policy Legal Subprocessors Cyber Insurance Data Processing Agreement View more Data Privacy Data Protection & Transfer Impact Summary Data Protection Officer (DPO) International Data Transfer Whitepaper View more Access Control Data Access Logging Infrastructure Google Cloud Platform Infrastructure Security Separate Production Environment Endpoint Security DNS Filtering Endpoint Detection & Response Mobile Device Management View more Network Security Firewall IDS/IPS Network Penetration Testing View more Corporate Security Email Protection Employee Training Incident Response View more Policies Acceptable Use Policy Access Control Policy Business Continuity/Disaster Recovery (BC/DR) Policy View more Security Grades Qualys SSL Labs login.bigcommerce.com A+ Knowledge Base (FAQ) Is system identity information and levels of access managed, stored, and reviewed? Is a process established and followed to review and take appropriate and timely actions on detected anomalies? Are requirements for non-disclosure/confidentiality agreements reflecting organizational data protection needs and operational details identified, documented, and reviewed at planned intervals? Is the ability to disable the "read-only" configuration of logging infrastructure controlled through a procedure that ensures the segregation of duties and break glass procedures? Is the deployment and integration of application code automated where possible? View more Commerce Trust Center Updates Security Notice Regarding Third-Party Fastr Applications Incidents On September 17, 2026, Commerce confirmed that API credentials belonging to third-party application developer “Be A Part Of,” a Fastr company, had been compromised as a result of a Fastr system compromise. This was not a breach of Commerce systems or the BigCommerce platform. The only way to be affected by this incident is for the merchant to have independently installed a Fastr developed application. Commerce has limited visibility into whether the actions taken by the application are valid or the result of the malicious actor. You should reach out of Fastr at support@getfastr.com for more information. Security Advisory: React Server Components CVE-2026-23864 Vulnerabilities We are aware of the recently disclosed React Server Components vulnerability, CVE-2026-23864 (CVSS 7.5), which affects certain versions of React Server Components used by frameworks such as Next.js. Commerce.com is not affected by this vulnerability. We have not identified any impact to our platform or customer environments. The vulnerability relates to denial-of-service scenarios triggered by specially crafted HTTP requests to React Server Component server functions. Importantly, this issue does not allow for remote code execution. We recommend that customers who independently use React Server Components in their own applications review the advisory and upgrade to a patched version if applicable. More information: https://vercel.com/changelog/summary-of-cve-2026-23864 Patched versions are available for affected React and framework releases, and users should upgrade as recommended by their framework maintainers. A critical severity vulnerability related to React Server Components has been disclosed affecting React versions 19.0, 19.1, and 19.2. Vulnerabilities A critical severity vulnerability related to React Server Components has been disclosed affecting React versions 19.0, 19.1, and 19.2. This includes Next.js which is used for internal applications at Commerce as well as customers building storefronts using Catalyst and Makeswift. For further details on the vulnerability, refer to Critical Security Vulnerability in React Server Components. https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components To avoid exposure, Next.js and React need to be updated to their latest patched versions. If you’re hosting your application on Vercel or are using Cloudflare’s WAF, those providers have platform level protections that help mitigate this vulnerability. However, upgrading to the latest versions of Next.js and React is strongly recommended. For further details refer to the Vercel (https://vercel.com/changelog/cve-2025-55182) and Cloudflare (https://blog.cloudflare.com/waf-rules-react-vulnerability/) blog posts. Here’s what else you need to know specific to Commerce. Actions we are taking All affected Next.js applications at Commerce have been upgraded to a patched version of Next.js, addressing the vulnerability. We’ve also released Catalyst v1.3.5 which ships with a patched version of Next.js. Actions you need to take If you are running a Catalyst-based headless storefront, you will need to update it to a version that includes the patched releases of Next.js and React. The following Catalyst versions incorporate these fixes. @bigcommerce/catalyst-core@1.3.5 @bigcommerce/catalyst-makeswift@1.3.6 For migration details, refer to the Catalyst 1.3.5 Release Notes. If you’re using a version of @bigcommerce/catalyst-b2b-buyer-portal, follow the manual steps outlined in the release notes. https://developer.bigcommerce.com/docs/storefront/catalyst/release-notes/1-3-5 Makeswift Makeswift customers that are not using Catalyst should follow the Makeswift blog post for specific mitigation steps. https://www.makeswift.com/blog/announcements/2025-12-03-react-server-components-vulnerability 2025 Penetration and Network Segmentation Test Summaries Posted Vulnerabilities As part of Commerce.com's continued commitment to transparency and best-in-class security practices, we have completed our 2025 third-party penetration and network segmentation assessments. Executive summaries of these evaluations are now available in the REPORTS section of our Trust Center. These annual tests assess the security posture of our applications, APIs, and mobile apps, feed management system, and include a comprehensive suite of network assessments—covering both internal and external networks, production segmentation, and the logical separation between customer storefronts. Together, these assessments validate the effectiveness of our overall security architecture and ensure the confidentiality, integrity, and availability of the Commerce.com platforms. All findings were reviewed and addressed in accordance with our risk management framework and remediation SLAs: 10 days for critical, 30 days for high, and 90 days for medium severity issues. To view the executive summaries, visit security.bigcommerce.com and navigate to the REPORTS card. European Accessibility Act (EAA) Compliance We're committed to creating an inclusive experience for all our customers. As part of this commitment, we want to inform you about the European Accessibility Act (EAA), which came into effect on June 28, 2025. This significant legislation aims to make a wide range of products and services, including digital platforms, more accessible for people with disabilities across the EU. We are actively working to ensure our offerings comply with these new standards, reflecting our dedication to universal access and an enhanced user experience for everyone. If you think you may have discovered a vulnerability, please send us a note. Report issue