The storefront compliance checklist.

Why a checklist at all? In the US, regulators decide what a product is by its intended use, and they read that intent from everything the seller publishes, not only the label [1]. The Federal Trade Commission separately expects any health-related claim to be backed by competent and reliable scientific evidence [2]. A research supplier makes no such claims, and the simplest way to prove it is a storefront where none can be found. Our article on research use only explains the background. This page is the practical part.

1. Access

• Catalog behind a login. Product pages, prices and the cart are visible only to signed-in customers. A visitor without an account sees your brand, your policies and a sign-in or registration page.
• Product feeds closed. Public product feeds, shopping feeds and catalog endpoints are disabled or require authentication, so the catalog cannot be read around the login wall.
• Search engines see what visitors see. Logged-out pages are the ones that get indexed, so they should contain nothing you would not show a regulator.

2. Wording

• Research-use statement on every product page. Plain and visible, near the product name or price: for laboratory research use only, not for human or animal use.
• The same statement in the footer, so it appears on every page of the site.
• No dosing language. No amounts per person, schedules, cycles, "protocols" or reconstitution guides written as instructions for use on a body.
• No claims of benefit. Nothing about health, weight, anti-aging, performance, recovery or any therapeutic effect. This includes blog posts, FAQs and summaries of studies.
• Images say the same thing. No lifestyle or before-and-after imagery, and no product photos staged for personal use.
• URLs and SEO titles too. A careful page with a slug or meta title written for consumer search still makes the claim. Check page titles, meta descriptions, image alt text and slugs.
• Reviews moderated. Customer reviews that describe personal use are statements published on your site. Remove them.

3. Products

• A certificate of analysis for each product, linked from the product page and matched to the batch you sell.
• Neutral product names. No name that borrows, imitates or abbreviates the brand of an approved medicine. Use the research designation of the material.
• Reference forms only. Lyophilized vials and reference materials. No capsules, sprays, ready-to-inject formats or anything presented for consumption.
• Nothing on the not-accepted list. Prescription medicines, controlled substances, anabolic steroids, SARMs, growth hormone, kratom or 7-OH, and nicotine are outside what we can carry. The full list is in our acceptable use policy.

4. Checkout

• A research-use attestation on every order. A checkbox the buyer must tick to pay, confirming the purchase is for laboratory research use only and not for human or animal use. It must not be pre-ticked.
• An age gate at 21+, confirmed by the buyer before purchase.
• The attestation is stored with the order. On Zonipay this is automatic: the record travels with the transaction and is attached to any dispute response.

5. Legal pages and technical health

• Refund, privacy, terms, shipping and contact pages all present and reachable from the footer.
• One legal name everywhere. The same legal entity named in every policy, on the contact page and in your merchant application.
• A refund policy at least as generous as the Zonipay minimum: wrong, damaged or undelivered items refunded or replaced, requests within 30 days of delivery. See our refund policy.
• Valid SSL on the store and a healthy checkout subdomain pointing at us.

How findings are handled

When the scanner finds something, the email names the exact page, what was found and the change needed. Screenshots and page snapshots are archived with every scan, so both sides can see the same evidence. Each finding carries one of three severities:

Most findings are wording and take minutes to fix. When you have made the change, reply to the finding email or write to compliance@zonipay.com, and the next scan confirms it. You can read everything the scanner checks on the compliance page.