Skip to main content

Report On Business Shopify’s IPO filing offers unique insight into digital age risks

Shopify – its headquarters pictured – stores customer payment credentials, which makes it a target for fraudsters.

Tim McKenna/The Globe and Mail

What risks does Shopify Inc. face now that it is filing for an initial public offering, seeking to raise $100-million and a listing on the New York and Toronto stock exchanges?

The Ottawa-based e-commerce startup has identified several business conditions that are somewhat unique to the digital age – from security to the reputation risks – particularly for an enterprise that offers its software as a service and seeks to become a so-called platform company.

The U.S. Securities and Exchange Commission requires companies to include "risk factors" in such regulatory documents. Sometimes regarded as legal boilerplate, in the case of Shopify they make for interesting reading.

Story continues below advertisement

Shopify is not merely imagining a hypothetical scenario when it says "a denial of service attack or security breach could delay or interrupt service to our merchants and their customers, harm our reputation or subject us to significant liability." That has happened to other companies – Sony's online Playstation gaming platform for instance – and Shopify confirms they have been targeted by distributed denial of service (DDoS) attacks in the past. Thus far, it has successfully fended off such assaults. The fact that Shopify stores customer payment credentials makes it a target in the increasingly high-stakes game of cat and mouse merchants play with fraudsters.

"The real risk is just making sure to keep the lights on, your reputation and your future is built on making sure you avoid any outages," says Peter Sheldon, vice-president and principal e-commerce analyst with Forrester Research Inc. "You are running hundreds of thousands of websites on behalf of customers." Keeping them free of service interruptions, even in the wild swings of the holiday season, is critical.

Shopify's F-1 paperwork spells out how service interruptions are more than just an inconvenience in today's business landscape: "A merchant could share information about bad experiences on social media, which could result in damage to our reputation and loss of future sales."

Shopify also lists its dependance on third-party software partners, such as its payment processing provider, Stripe Inc. In reality, it's not cost effective for a single company to try to code or build every part of a big "Saas" solution (a software distribution model) entirely by itself any more.

"We mitigate that by having more partnerships, not having a single point dependency," says Vince Mifsud, CEO of another Canadian Saas startup, ScribbleLive Inc. The company provides liveblogging and communication tools for marketers and publishers.

The flexibility of services offered on a platform can help defend against disruptions.

"A platform has more than one customer type," says Andrew Reid, founder and president of marketing services provider Vision Critical. "Some companies, you worry what happens when the well dries up, or if you have fished it out. Companies have to have multiple ways they can fish or hunt."

Story continues below advertisement

But while these are the dangers common to all Saas companies, Mr. Sheldon warns Shopify has more direct challenges too. Most of Shopify's 162,000 clients record sales of less than $1-million annually, and Mr. Sheldon warns that if Shopify tries to move upmarket and attract the largest-scale commerce and retail customers it will find stiff competition and much more advanced features being offered by competitors such as Oracle.

"At least with a current maturity with the platform, there is a ceiling on the size of customer they can go after," Mr. Sheldon says.

Report an error Editorial code of conduct
Tickers mentioned in this story
Unchecking box will stop auto data updates
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed.

Read our community guidelines here

Discussion loading ...

Cannabis pro newsletter