Tools and providers
Part of Investigating ecommerce platforms with dated supplier evidence and eight independent gates
Ecommerce software selection: map requirements before any platform trial
Select ecommerce software for an England merchant through a dated requirements map, evidence register, controlled trial and reversible contract decision.
Choose software only after writing down the store that must operate. For this guide, the case is an England-based merchant selling its own physical consumer goods to UK adults. It has one legal seller, a controlled catalogue, parcel fulfilment and no third-party marketplace sellers. A different product, territory or seller structure needs a fresh assessment.
What to take away
- Write down the store that must operate before choosing any software.
- Mandatory gates include seller identity, versioned product facts, restorable catalogue export and reconciled payment events.
- Record supplier statements as inputs, not test results, and mark undisclosed items as unknown.
- Normalise whole-life cost with a blank merchant calculation that separates payment charges from subscription.
- Approve only when every critical gate has an owner, current record and passing result.
Turn the current journey into requirements
Start with an order trace from product record to refund. Name the owner and evidence for catalogue approval, stock state, price and tax inputs, order acceptance, payment authorisation and capture, fulfilment, cancellation, return, refund and dispute. GOV.UK's online-selling guidance identifies information and ordering steps that an online seller must address. It does not certify any software configuration.
Mark requirements as mandatory, useful or excluded. Mandatory gates for this case include a clear seller identity, versioned product facts, restorable catalogue export, reconciled payment and refund events, accessible customer tasks, privacy controls, incident evidence and a workable exit. Optional marketing functions cannot offset failure of one of these gates.
Build a dated evidence register
For each candidate, record the legal contracting party, exact plan or software release, UK availability, public price basis, renewal period, payment conditions, feature source, usage limit, integration owner, support route and termination terms. Save the page or contract version and give it an expiry date.
Supplier statements are inputs, not test results. For example, Shopify documents separate product CSV export and order export processes. The order file can include captured-payment history but excludes authorisation data. That distinction belongs in the exit test rather than a vague "export available" tick.
Where a supplier page does not disclose VAT treatment, configured accessibility, sub-processors, data location, recovery evidence or complete export coverage, write "unknown". Do not fill the cell from a marketing page or another edition.
Compare the whole operating route
Normalise cost as a blank merchant calculation:
annual whole-life cost = subscription + payment charges + extensions + hosting + integration + internal labour + assurance + support + migration + exit
Keep payment-provider charges separate from the software subscription. Shopify's billing overview says plan, card and third-party transaction charges can differ, and that external providers charge separately. A WooCommerce build shifts hosting, gateway and update work to chosen components; its current server recommendations therefore form part of the evidence.
Test safely before commitment
Use a sandbox or staging site with synthetic products, fictional customers and test payment modes authorised by the provider. Exercise price display, keyboard-only checkout, failed and duplicate orders, stock conflicts, refunds, permissions, privileged access, outage communication, catalogue export, order export and restore. Never place real customer details in a trial simply because a supplier offers one.
The ICO says a controller using a processor needs a binding arrangement, while noting its controller-processor contract guidance is under review following the DUAA. Privacy counsel must confirm roles and current terms. The NCSC's supplier assurance questions provide a separate route for testing security evidence and recovery claims.
Approve only when every critical gate has an owner, current record and passing result. Otherwise repair the existing route, narrow scope, negotiate evidence or hold the purchase. Recheck price, plan, contract and regulator pages on the decision date.
Before you act
- Trace an order from product record to refund.
- Mark each requirement as mandatory, useful or excluded.
- Build a dated evidence register for each candidate.
- Compare the whole operating route using a blank cost calculation.
- Test safely in a sandbox with synthetic data.
- Recheck price, plan, contract and regulator pages on the decision date.
Common questions
What must a merchant do before trialling any ecommerce platform?
Write down the store that must operate first. Start with an order trace from product record to refund, naming owners and evidence for each step. Mark requirements as mandatory, useful or excluded. Mandatory gates include seller identity, versioned product facts, restorable catalogue export and reconciled payment events.
How should a merchant treat supplier claims about features like export?
Treat supplier statements as inputs, not test results. For example, Shopify documents separate product CSV and order export processes, but the order file excludes authorisation data. That distinction belongs in the exit test. Where a supplier page does not disclose VAT, accessibility, sub-processors or recovery evidence, write unknown.
What should a merchant do before committing to a purchase?
Test safely in a sandbox with synthetic products, fictional customers and test payment modes. Exercise price display, keyboard-only checkout, failed orders, refunds, permissions, outage communication and exports. Approve only when every critical gate has an owner, current record and passing result. Otherwise repair, narrow scope, negotiate evidence or hold the purchase.
