Ecommerce platforms selection checklist: independent UK evidence gates

• Exact legal seller, trading name, address, customer geography and goods are approved.
• The proposed platform, plan or core version, payment service, host, apps and implementation supplier are named.
• Seller and supplier contracts identify parties, term, changes, liability, support, termination and surviving duties.

Merchant and seller record

• Legal seller, trading name, address approved
• Customer geography and goods approved
• Platform, plan, version, payment service named
• Host, apps and implementation supplier named
• Contracts identify parties, term, liability, termination

• Every catalogue claim has an owner, source, date, rights record and correction route.
• Total-price, delivery, order correction, acceptance, confirmation, cancellation, return and refund states have observable evidence.
• Stock conflicts and duplicate orders have defined handling.
• A product can be traced, blocked, corrected and withdrawn across open orders and customer communications.

• Payment authorisation, capture, settlement, refund, dispute and provider-fee events reconcile separately for whichever of Stripe, PayPal, Adyen, Worldpay, Klarna, GoCardless or a direct card acquirer is proposed.
• Card data flow, PCI DSS scope and strong customer authentication (SCA) under the Payment Services Regulations 2017 are evidenced for the configured build, with the self-assessment questionnaire that applies (SAQ A, SAQ A-EP or SAQ D) named and the party that completes it identified.
• Chargebacks follow the card scheme rules and each provider's own dispute process.
• No party receives money for another seller without an FCA perimeter decision from a qualified lawyer.
• The accountant owns ledger mapping; the tax adviser owns VAT treatment and evidence retention, including the registration threshold that applies to the merchant's turnover.
• Registration and filing are checked before launchICO registration and the data protection fee tier that applies to the business, and VAT registration with HMRC where the merchant's turnover requires it.
• Recorded before proposalsreconciliation tolerance, investigation owner and stop condition.

• Controllers, processors, purposes, lawful bases, data fields, recipients, retention and deletion are documented.
• Cookies, pixels and other device access are mapped by purpose and current rule.
• Direct-marketing permission and suppression remain separate from order-service messages.
• Least-privilege roles, single sign-on (for example Okta or Microsoft Entra ID), joiner and leaver steps, privileged-event logs and access reviews are tested.

• Disabled users and an accessibility specialist test catalogue, basket, checkout, authentication, errors and support in the configured build against WCAG 2.2 level AA and EN 301 549.
• Security evidence matches the contracting entity, service boundary, locations and dates, and is tested against a named scheme: Cyber Essentials, ISO/IEC 27001 or SOC 2.
• Incident detection, containment, communication, clean recovery and retrospective ownership are rehearsed.
• Recorded before proposalssupport measure event, population, clock start and stop, exclusions and threshold.

• Catalogue, images, customers, orders, payments, refunds, tax evidence, permissions and audit events have field-level export maps as CSV files and documented API schemas.
• Contract and law define what must be retained; deletion covers supplier and sub-processor copies where applicable.
• A fresh environment restores the agreed records and preserves relationships, identifiers, encodings and timestamps.
• Supplier outage, price or term change, integration failure and closure have owners and decision triggers.
• Recorded before proposalsmaximum tolerated data loss, recovery time threshold and restart authority.

• Each named candidateShopify, WooCommerce, BigCommerce, Adobe Commerce, Wix and Squarespace — is recorded on the same evidence date against the capabilities the gates above depend on, not against marketing pages.
• Which of Stripe, PayPal, Adyen, Worldpay, Klarna, GoCardless or a direct acquirer each candidate supports, and who completes the PCI DSS self-assessment questionnaire in that configuration.
• VAT and tax handling for UK and cross-border sales, invoicing, reporting and evidence retention.
• Multi-channel selling, marketplace and app-ecosystem integrations, and how each one affects the data gates above.
• Migration and exit toolingfield-level CSV exports, documented API schemas, URL redirects, and transfer of customer and order history.
• Total cost of ownership is evidenced in writing by each supplier for the same basket of requirements: subscription or licence, transaction and payment fees, app and theme costs, implementation, support and exit costs. Ask each supplier for the figures rather than accepting a range.

• Define one England merchant operation before starting the comparison.
• Fill in every blank threshold before requesting proposals.
• Compare each candidate against the same synthetic test pack.
• Mark each gate pass, fail or hold and cite evidence.
• Remove a candidate after any mandatory fail.
• Reopen supplier and official pages on decision day.