Investigating ecommerce platforms with dated supplier evidence and eight independent gates

An England merchant investigating ecommerce platforms should not begin with a feature chart. Begin with the customer contract and work needed to fulfil it. Then compare supplier editions against the same catalogue, payment, delivery, support and exit case. A candidate stays on hold when a critical fact is missing, even if price or demonstration looks attractive.

This guide uses public records from 6 September 2026. It does not identify a universal best platform. It frames a reproducible investigation for a 2027 decision.

What to take away

The merchant case used here

The reference operator is one legal seller established in England. It sells its own physical consumer goods to adults in the UK, holds or controls stock, uses parcel delivery and accepts card payments. It does not operate a marketplace for other sellers, offer credit or sell regulated products.

That boundary matters. HMRC defines an online marketplace for the cited VAT guidance through involvement in terms, payment and ordering or delivery, not merely the word "platform". Its marketplace VAT page also varies treatment with seller establishment, goods location and customer type.

The FCA separately warns that an intermediary receiving customer money before passing it to a seller may be providing payment services in its perimeter guidance. A merchant with other sellers, stored value, cross-border stock or financial products needs a different model and specialist review.

Specify the service before searching

Write a one-page operating statement. It should identify:

Follow one item through the journey. Catalogue states should include draft, checked, published, paused, corrected and withdrawn. Order states should distinguish initiation, payment authorisation, capture, acceptance, fulfilment, cancellation, return, refund, dispute and cash settlement. This stops a supplier's single "paid" or "complete" label hiding an unresolved accounting or customer event.

GOV.UK's online-selling page sets out payment acknowledgement, delivery options and contract confirmation. Its distance-selling section describes pre-contract information and cancellation rules while recording exceptions. These sources define review questions, not a platform certificate.

Use a reproducible commercial investigation

Create a candidate register with one row per legal entity, product and edition. Give each source an access date and a refresh trigger. The evidence hierarchy is:

Exclude a candidate when its contracting entity or intended UK availability cannot be verified, essential terms are inaccessible, a mandatory function requires an unidentified third party, or the merchant cannot test recovery and exit. Do not treat sales copy, an unscoped badge, a review score or another merchant's anecdote as proof.

A dated, non-ranked evidence shortlist

Three routes have enough official public material to illustrate the method. They are not recommendations. The existing service remains the control because repair can be safer than migration.

Price claims above are supplier-published snapshots, not quotations. Currency, billing cadence, card geography, transaction event, promotions and exclusions are material. Recheck the exact page, contract and invoice basis on the decision date. Do not compare a hosted subscription with a free plugin without adding infrastructure and labour.

Compare cost without manufacturing precision

Use the merchant's observed volumes and quotations in a blank model:

whole-life cost = platform subscription + payment charges + hosting + extensions + integration + internal labour + accessibility and legal assurance + support + incident work + migration + exit

Payment cost needs separate variables for successful UK-card transactions, other cards, refunds, disputes and any platform fee. Shopify's current pricing and billing overview says subscription, card and third-party charges can differ, and an external payment provider charges separately.

Square publishes an official fee schedule that should prevail over an undated summary. For WooCommerce, the selected gateway and hosting arrangement supply those inputs.

Keep gross customer payments, fees, refunds, disputed amounts, VAT, cash received and taxable profit distinct. HMRC's collection on selling through marketplaces or directly shows that route and goods location matter. A named tax adviser should approve the treatment. The calculator should expose uncertainty, not turn missing amounts into zero.

Keep eight assurance gates independent

Eight independent gates are checked, each marked pass, fail or unknown:

The eight gates are seller and consumer, product-safety, privacy and PECR, payment and tax, accessibility, security and resilience, integration and operations, and contract and exit.

Seller and consumer gate

Confirm the seller's identity and every pre-order, order and after-sale step in the configured journey. Test optional charges, cancellation, return, refund and complaint handling. Supplier templates can help present information, but the merchant owns the facts and qualified consumer-law review.

Product-safety gate

Link each listing version to supplier traceability, product classification, technical records, warnings, instructions and incident status. OPSS product-safety advice for businesses notes responsibilities for UK sellers and distinguishes Great Britain from Northern Ireland. A catalogue field does not establish that a product is safe.

Privacy and PECR gate

Map personal data by field, purpose, role, lawful basis, recipient, retention and deletion. Obtain current processor and sub-processor terms.

The ICO says controller and processor relationships require binding arrangements. It flags its contract material for review after the Data (Use and Access) Act. Its final April 2026 storage and access technologies guidance covers cookies, pixels and similar technologies. A banner alone cannot answer the purpose and consent questions.

Payment and tax gate

Identify who receives funds, who provides regulated payment services, and how each event reaches accounting. Reconcile authorisations, captures, refunds, disputes, platform deductions and bank settlement. Obtain FCA, accounting and tax review for the actual structure rather than relying on a platform category.

Accessibility gate

Test browse, search, product, basket, checkout, authentication, account, cancellation, return and support with keyboard and relevant assistive technologies. Include error messages, timeouts, third-party payment screens and documents. The configured merchant service needs evidence; neither a theme claim nor a supplier statement proves accessible combinations and content.

Security and resilience gate

Assess administrator access, authentication, logging, vulnerabilities, dependencies, backup, incident communication and recovery. The NCSC's supplier assurance questions cover governance, networks, data, offshoring, independent testing and contractual controls. Evidence must match the contracted service, location and date. Do not turn the supplier's certificate into a guarantee for the merchant's configuration.

Integration and operations gate

Assign owners for product feeds, stock updates, fulfilment messages, payment callbacks, tax inputs and customer support. Specify failure states and a manual route. A functioning demonstration is not proof of sustained availability or data integrity.

Contract and exit gate

Check legal entity, service scope, service changes, support, data roles, security incidents, price renewal, liability, suspension, termination and continuity. Define export fields and formats for catalogue, orders, customers, permissions, suppressions, settlements, content, configuration and audit records. Retain enough access to resolve open refunds, disputes, recalls and data requests.

Test with synthetic records

Build a staging catalogue with invented names, authorised images, variants, delivery restrictions and an unavailable item. Create fictional customers and use the provider's approved test-payment method. Cover successful, declined, abandoned, duplicate, cancelled and refunded orders. No live customer record belongs in a sales trial without a separately approved basis and controls.

Include these acceptance tests:

Record actual result, configuration, tester, date and defect. A failed legal, safety, privacy, payment, accessibility or security gate cannot be averaged away by easier editing or a lower forecast cost.

Contract for evidence and change

The schedule should name the product and plan, territories, roles, integrations, support channels, accepted configuration and exclusions. Attach fee and data-processing records rather than linking to pages that may change without an internal copy. Set notices for changes that affect price, sub-processors, payment routes, export or essential functions.

Define incident responsibilities, investigation access, restoration evidence and customer communications. Specify what happens to outstanding orders, refunds, chargebacks, product incidents and rights requests on suspension or termination. Ask for export and deletion evidence that is specific enough to test.

Do not promise an unsupported service level. Define each operational measure by event, population, unit, clock start and stop, exclusions, source, owner and response. The merchant can negotiate thresholds that match its own risk instead of copying a vendor's marketing claim.

Make a reversible decision

Use pass, fail and unknown, not a weighted score that lets optional features cancel mandatory controls. The procurement owner compiles the file, but separate named reviewers decide consumer, commercial, product-safety, privacy and PECR, payments, tax, accessibility and cyber-security gates.

Choose a route only when evidence is current, whole-life cost understood, authorised tests pass, material unknowns have owners, and exit restored successfully.

Hold when seller role is unclear, payment cannot reconcile, product evidence can detach, or the customer journey is inaccessible. Also hold when data terms do not fit processing, security evidence lacks scope, or the merchant cannot recover records.

Before a 2027 launch, reopen supplier prices, plans, fees, terms, availability, limits, sub-processors and regulator pages. Record what changed and rerun affected tests. The decision may be a new service, a narrower deployment, negotiated evidence or improvement of the current route. The conclusion must follow the same merchant case and survive independent review.

Before you act

Common questions

What should a merchant do first instead of comparing feature charts?

Begin with the customer contract and the work needed to fulfil it. Then compare exact supplier editions against the same catalogue, payment, delivery, support and exit case. A candidate stays on hold when a critical fact is missing, even if its price or demonstration looks attractive.

Why are the three listed routes not recommendations?

The article states they are not recommendations and that the existing service remains the control because repair can be safer than migration. They are included only because they have enough official public material to illustrate the method, not because they suit the reference operator.

Why is a free WooCommerce core plugin not a full operating price?

The supplier describes the core plugin as free, but hosting, payment, extensions, maintenance and labour sit outside that description. The chosen host, gateway, theme, extensions, support route, security operation, order portability and total cost remain configuration-specific, so the free label alone is misleading.