Skip to main content

Shopify – its headquarters pictured – stores customer payment credentials, which makes it a target for fraudsters.Tim McKenna/The Globe and Mail

What risks does Shopify Inc. face now that it is filing for an initial public offering, seeking to raise $100-million and a listing on the New York and Toronto stock exchanges?

The Ottawa-based e-commerce startup has identified several business conditions that are somewhat unique to the digital age – from security to the reputation risks – particularly for an enterprise that offers its software as a service and seeks to become a so-called platform company.

The U.S. Securities and Exchange Commission requires companies to include "risk factors" in such regulatory documents. Sometimes regarded as legal boilerplate, in the case of Shopify they make for interesting reading.

Shopify is not merely imagining a hypothetical scenario when it says "a denial of service attack or security breach could delay or interrupt service to our merchants and their customers, harm our reputation or subject us to significant liability." That has happened to other companies – Sony's online Playstation gaming platform for instance – and Shopify confirms they have been targeted by distributed denial of service (DDoS) attacks in the past. Thus far, it has successfully fended off such assaults. The fact that Shopify stores customer payment credentials makes it a target in the increasingly high-stakes game of cat and mouse merchants play with fraudsters.

"The real risk is just making sure to keep the lights on, your reputation and your future is built on making sure you avoid any outages," says Peter Sheldon, vice-president and principal e-commerce analyst with Forrester Research Inc. "You are running hundreds of thousands of websites on behalf of customers." Keeping them free of service interruptions, even in the wild swings of the holiday season, is critical.

Shopify's F-1 paperwork spells out how service interruptions are more than just an inconvenience in today's business landscape: "A merchant could share information about bad experiences on social media, which could result in damage to our reputation and loss of future sales."

Shopify also lists its dependance on third-party software partners, such as its payment processing provider, Stripe Inc. In reality, it's not cost effective for a single company to try to code or build every part of a big "Saas" solution (a software distribution model) entirely by itself any more.

"We mitigate that by having more partnerships, not having a single point dependency," says Vince Mifsud, CEO of another Canadian Saas startup, ScribbleLive Inc. The company provides liveblogging and communication tools for marketers and publishers.

The flexibility of services offered on a platform can help defend against disruptions.

"A platform has more than one customer type," says Andrew Reid, founder and president of marketing services provider Vision Critical. "Some companies, you worry what happens when the well dries up, or if you have fished it out. Companies have to have multiple ways they can fish or hunt."

But while these are the dangers common to all Saas companies, Mr. Sheldon warns Shopify has more direct challenges too. Most of Shopify's 162,000 clients record sales of less than $1-million annually, and Mr. Sheldon warns that if Shopify tries to move upmarket and attract the largest-scale commerce and retail customers it will find stiff competition and much more advanced features being offered by competitors such as Oracle.

"At least with a current maturity with the platform, there is a ceiling on the size of customer they can go after," Mr. Sheldon says.