Engineering a Historic Moment: Shopify Gets Ready for Cannabis in Canada

Summary

Canada’s 2018 cannabis legalization required Shopify to support a new, tightly regulated retail industry while keeping personal information in Canada. Using Google Cloud Platform’s Montreal region, the team created a Canadian Shopify instance with Terraform-managed projects, regional clusters, segregated workloads, PCI-compliant payment infrastructure, and a regional data warehouse. Because consumer behavior and peak demand were uncertain, engineers modeled traffic scenarios, ran repeated load tests across storefront actions, tested bot attacks, held pre-mortems, and provisioned five times projected launch traffic and sales. Multiple safeguards—including application-level endpoint checks, firewalls, limited secrets, unique SSL certificates, monitoring, and alerting—were layered to prevent data from crossing jurisdictions. Merchants opened across time zones, and the first legal sale occurred on Shopify’s point of sale in Newfoundland at 12:01 NST, followed by launches with zero downtime, excellent performance, and secure Canadian data storage and transmission.

Takeaways

1. 1

   Shopify created a Canadian regional deployment in Google Cloud Platform’s Montreal region, including PCI-compliant payment infrastructure and a regional data warehouse.

2. 2

   Capacity planning used uncertain consumer behavior as an input, with multiple traffic models, repeated load tests, bot-attack testing, and infrastructure sized for five times projected launch traffic and sales.

3. 3

   Canadian data residency was enforced in layers across the application, hosts, and network infrastructure through endpoint validation, firewalls, restricted credentials, unique SSL certificates, monitoring, and alerting.

FAQ