Every store, read every 8 hours.
As merchant of record we answer for every sale on every store we serve. So we review each storefront before its first sale and scan it again every eight hours after, against one published set of rules. Findings go to the merchant with the exact page and the exact change needed.
Before the first sale. Then on a clock.
A store cannot take a payment until its storefront has passed review. After launch, the scanner returns three times a day, every day.
Eight hours between scans. Exact times differ from store to store. A new finding is emailed as soon as the scan that found it completes.
The full list, with severity.
The scanner reads your store as a signed-out visitor, as a signed-in customer and at checkout. The severity shown is the usual one; each finding email states the severity of that finding.
| Check | What passes | Where we look | Usual severity |
|---|---|---|---|
| Access | |||
| Login wall | Catalog, prices and cart visible only to signed-in customers. | Signed-out pages | Critical |
| Closed product feeds | No public product feeds, catalog endpoints or shopping feeds that expose products or prices. | Feeds, sitemaps | Critical |
| Age gate | Visitors confirm they are 21 or older before entering. | Entry pages | Critical |
| Presentation | |||
| Research-use statements | A research-use-only statement on every product page and in the site footer. | Products, footer | Warning |
| No claims | No dosing, health, weight, anti-aging, performance or therapeutic claims. | Text, images, URLs, SEO titles | Critical |
| Product names | No name that borrows the brand of an approved medicine. | Names, URLs, titles | Critical |
| Product form | Lyophilized vials and reference forms only. No capsules, sprays or ready-to-inject products. | Products, images | Critical |
| Certificates of analysis | A certificate of analysis available for each product. | Product pages | Warning |
| Checkout | |||
| Buyer attestation | Research-use attestation at checkout, mandatory and not pre-ticked. | Checkout | Critical |
| SSL and checkout domain | Valid certificate on the store and on the checkout subdomain, which resolves correctly. | Store, checkout | Critical |
| Business information | |||
| Policy pages | Refund, privacy, terms, shipping and contact pages present and reachable. | Footer, policies | Warning |
| Consistent legal name | The same legal business name across every policy and contact page. | Policies, contact | Warning |
| Changes since last scan | Noted for context: new products, edited pages, changed policies. | Whole site | Info |
The rules in full are in our compliance policy. A practical walk-through: storefront compliance checklist.
What a scan returns.
Each scan produces a report with a score and a line per check. These three are illustrations of a clean store, a store with warnings, and a store with a critical finding.
A precise email, a clear deadline.
You never get a vague warning. Each finding names the page, quotes what we found, and says what to change. When you have fixed it, reply or wait for the next scan to confirm.
To correct the finding. If it is still open after 48 hours, payments can be paused until it is fixed.
To correct the finding. Open warnings are followed up by our compliance team until they are resolved.
Context for you and for us, such as new products since the last scan. No action required.
From finding to fix.
Found
The scan records the page, a screenshot and a snapshot of its HTML.
Emailed
To your account contacts, with severity, page, quote and the change needed. A
compliance.findingwebhook is sent if you use the API.Fixed
You edit the page. Most findings are wording and take minutes.
Confirmed
The next scan checks the page again and closes the finding.
- Severity
- Critical
- Check
- No claims
- Page
- /products/reference-peptide-10mg
- Found in
- SEO title:
"Reference peptide 10 mg, dosing guide" - Change
- Remove dosing wording, for example: "Reference peptide 10 mg, lyophilized, research use only"
Every scan, on file.
For each scan we keep screenshots and page snapshots of what the scanner saw. That record shows what the store looked like at a given time, which matters to you, to us and to the card networks.
- Screenshots and HTML snapshots stored per scan
- Findings linked to the exact capture they came from
- Available to you in your dashboard
The other side of the counter.
Rules for stores are half the job. Every order also passes checks on the buyer.
21 or older
An age gate on the store and a confirmation at checkout.
Research only
A mandatory attestation, never pre-ticked, stored with the order.
Screened
We can block buyers, or regions where sales are restricted.
Checked
No sales to sanctioned persons or countries.
What buyers agree to: buyer terms. Help for buyers: buyers.
Accepted and declined, said plainly.
Accepted
- Lyophilized research peptides sold as reference materials
- Analytical standards and reagents
- Laboratory consumables
- Registered businesses selling to laboratories, institutions, businesses and qualified researchers aged 21+
Declined
- Products marketed for human consumption, injection or dosing
- Prescription medicines and controlled substances
- Anabolic steroids, SARMs and growth hormone
- Kratom and 7-OH, nicotine
- Anything with health, weight-loss, anti-aging or performance claims
- Product names that borrow approved-medicine brands
- Sales to minors, or resale for human use
- Unregistered businesses, sanctioned persons or countries
Read the policies.
The scanner enforces what these documents say. If something is unclear, write to compliance@zonipay.com.
About compliance.
Will a finding stop my payments straight away?
No. A critical finding gives you 48 hours to correct it. Payments can be paused only if it is still open after that, and resume once the fix is confirmed.
Do you scan pages behind my login?
Yes. During onboarding you give us a customer account for the scanner, so it can check product pages, certificates and checkout as a signed-in buyer would.
Can I ask for a rescan after fixing something?
Reply to the finding email and tell us what you changed. Otherwise the next scheduled scan, at most eight hours later, checks it.
What if I disagree with a finding?
Reply with your reasons. A person reviews it against the compliance policy and answers you.
Ready for review?
Apply, and we scan your storefront as part of review. If changes are needed, you get the list.