UltraCart

United States · www.ultracart.com · 11 vendors

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 11 sub-vendors.

Insights

Last updated 2026-08-15 · revision 1

11 direct vendors, 168 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

UltraCart demonstrates strong indicators for migration readiness. Its internal tech stack includes Google BigQuery and Google Cloud IAM, signifying existing cloud adoption and familiarity with cloud-native services. The presence of REST API and Webhooks suggests a modular and API-driven architecture, which greatly facilitates migration to modern cloud environments. Support for a diverse set of programming languages (TypeScript, JavaScript, PHP, Java, Python, Ruby, C#) implies development flexibility and potential for microservices adoption. Furthermore, PCI DSS Level 1 compliance indicates a structured approach to security and regulatory requirements, which can streamline the migration process. Key challenges and unknowns include the lack of data on UltraCart's financial stability, which is crucial for funding a migration initiative. Data residency requirements are also not specified, which could introduce complexities. The vendor relationship data presents an ambiguity with "Total Vendors: 0" conflicting with other vendor details like "Total Services: 15" and vendor geographic diversity. While the explicit vendor lock-in risk is unknown, the number of services suggests some external dependencies. However, the overall modern and cloud-compatible tech stack positions UltraCart favorably for migration.

Compliance

7 in-scope frameworks identified; showing 3.

CAN-SPAM Act — Assessment Required

UltraCart provides built-in email campaign, marketing automation, and SMS marketing (Twilio-powered) tools to its merchant customers. As a platform enabling bulk commercial email and SMS communications, UltraCart and its merchants must comply with CAN-SPAM Act (email) and TCPA (Telephone Consumer Protection Act, SMS/text marketing). Risk is Medium because: (1) UltraCart is the platform provider, not the sender, reducing its direct CAN-SPAM/TCPA exposure; (2) However, as an email/SMS service provider, UltraCart has platform-level obligations to prevent abuse; (3) TCPA violations carry statutory damages of $500-$1,500 per violation and class action exposure; (4) No public documentation of CAN-SPAM/TCPA compliance controls at the platform level was found.

Evidence: https://www.ultracart.com/resources/communication/sms-marketing, https://www.ultracart.com/resources/communication/email-campaigns, https://www.ultracart.com/legal/terms-and-conditions.html

SOC 2 (source) — Assessment Required

UltraCart is a cloud-based SaaS eCommerce platform that stores and processes sensitive merchant and customer data including payment information, order data, customer PII, and CRM data. SOC 2 is highly relevant for cloud service providers of this nature, as enterprise and mid-market merchant customers increasingly require SOC 2 Type II reports as part of vendor due diligence. The absence of any publicly disclosed SOC 2 report or attestation is a notable gap for a platform of UltraCart's scope. Risk is Medium because: (1) UltraCart has strong PCI DSS Level 1 certification which covers significant security controls overlapping with SOC 2 Trust Service Criteria; (2) However, SOC 2 covers broader operational controls (availability, confidentiality, processing integrity, privacy) beyond PCI scope; (3) Lack of SOC 2 may limit UltraCart's ability to serve enterprise customers with strict vendor compliance requirements.

Evidence: https://www.ultracart.com/resources/pci-compliance.html, https://www.ultracart.com/legal/privacypolicy.html

FTC Act — Assessment Required

As a US-based eCommerce platform provider, UltraCart is subject to FTC Act Section 5 prohibitions on unfair or deceptive acts or practices. The FTC has jurisdiction over eCommerce platforms and SaaS providers. Risk is Low because: (1) UltraCart's published terms, privacy policy, and compliance documentation do not reveal obvious deceptive practices; (2) The company explicitly states it will never sell merchant data; (3) PCI DSS Level 1 certification demonstrates security commitment; (4) No FTC enforcement actions against UltraCart have been identified. Assessment Required because the outdated privacy policy and absence of CCPA disclosures could attract FTC scrutiny under its privacy enforcement authority.

Evidence: https://www.ultracart.com/legal/privacypolicy.html, https://www.ultracart.com/legal/terms-and-conditions.html

Financials

Three-year financials

Financial Resilience Score: 6/10

UltraCart, operated by BPS Info Solutions, Inc., is a privately held US SaaS eCommerce platform with an approximately 20-year operating history. Its qualitative profile suggests moderate financial resilience: a recurring subscription revenue model provides predictable cash flow with low working-capital needs, and the company has sustained continuous product development and market presence since the early 2000s without publicly known outside funding, implying self-sustaining operations. However, the company operates at a small scale in a market dominated by well-capitalized rivals such as Shopify, BigCommerce, Adobe Commerce, and WooCommerce, which vastly outspend it on R&D and marketing. No audited financials, headcount, or segment breakdowns are publicly available, making objective credit or resilience assessment difficult. Dependence on third-party payment processors (notably PayPal) and cloud infrastructure, plus PCI-DSS and privacy regulatory exposure, add operational risk. Overall, the long track record and recurring revenue base support a moderate resilience rating, tempered by opacity, small scale relative to competitors, and the need to keep pace with AI-driven platform investment.

Key strengths: Approximately 20-year operating history in hosted eCommerce SaaS, Recurring monthly SaaS subscription revenue model billed in USD, Broad all-in-one product suite (checkout, CRM, marketing, AI, analytics, POS), Established payment ecosystem integrations (PayPal, Stripe, Authorize.net, crypto), US-based support and US HQ appealing to domestic SMB merchants, Continued product innovation including AI agents and AI commerce features

Risk factors: No publicly available audited financial statements (private company opacity), Small scale versus much larger, better-capitalized competitors (Shopify, BigCommerce, Adobe Commerce, WooCommerce), Unknown customer concentration; potential exposure to loss of larger merchants, Heavy dependence on third-party payment processors, especially PayPal, PCI-DSS and GDPR/CCPA regulatory exposure as a merchant services provider, AI investment race against much larger rivals with greater R&D budgets, No known outside institutional investment; growth largely self-funded, No published foreign subsidiaries limiting geographic diversification

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report