Your compliance score, issues and certificate

What this does

Compliance reads your live storefront the way a payment processor's reviewer would, scores it out of 100, and lists everything that would stop a review — with the exact text to put in its place. It re-checks the site every week and tells you when something changes.

It comes with Command, and it appears once your own domain is active rather than as soon as you subscribe: the address a reviewer opens is your domain, so that is the address we watch. Torva already applies these rules as you edit inside the Desk. This checks what the published site actually says, every week, and catches the drift an editor cannot — a product added in a hurry, a description pasted from a supplier, a page you wrote yourself.

Before you start

You need owner or admin access to the workspace, and your domain has to be active and publicly reachable: Compliance reads the same pages any visitor can open and never asks for your admin login.

Steps

### Read your score The dial is your score out of 100. Below it is the band — Ready for review, Nearly there, At risk or Would be declined — and the date of the last check. The score starts at 100 and every issue takes off what its rule is worth, capped per rule so one bad category cannot hide the rest. Fix the top item, rescan, and the number moves by an amount you could have predicted.

Nothing here is a statement about a payment provider's decision. Each provider makes its own, and no platform can promise one.

### Work through the issues Open issues are ordered worst first. Each one names the page it is on and the element on that page, then shows what your site says now and what to put instead:

• A compound name processors decline becomes a code in whichever style your site already uses — GLP-1 (SM), GLP-1SM or GLP-1 (SG). Bacteriostatic water becomes Reconstitution Solution.
• A health, dosing or effect claim is deleted. Nothing replaces it: a research-supply listing describes what a product is, its purity and its format, and says nothing about what it does in a person.
• A missing or thin policy comes with a complete shipping, refund, privacy or terms page written for your store, with your own contact details and research-use restriction in it.
• A missing 21+ gate, research-use notice or checkout confirmation comes with the wording to use.
• A photo whose file name carries a compound is flagged. Re-upload it under a neutral name, and check the label printed on the vial in the picture — we cannot read that, and a reviewer can.

Use Copy the replacement and paste it into the page the issue names — in Storefront Studio, or in the product, page or policy editor. Nothing is rewritten for you: the scan reports and never edits, so your words stay yours until you change them.

### Rescan Press Rescan now once you have made changes and published them. This is limited to one manual scan an hour; the button says when the next one is available. The automatic weekly check is separate and never spends this allowance.

### Keep your certificate A scan scoring 90 or more with nothing critical or serious outstanding earns Torva Verified: a public certificate page showing your store name, your domain, the date it was verified and whether it still holds. Copy the badge code into your site's footer.

A certificate that could not go stale would be worth nothing, so a later weekly check that fails moves it to lapsed until the next clean scan. If the weekly check stops altogether — your store leaves Command, or the domain goes away — the certificate moves to expired instead: it keeps showing the date it was earned and says plainly that the site is no longer being re-checked. Torva only vouches for what it checked, on the day it checked it. The certificate carries no personal data and no part of your issue list.

### Read your alerts Alerts appear on this page when something changes: your score dropped, a new issue a processor would stop at, your certificate was earned or lapsed, or we could not reach your site. Mark them read when you have dealt with them. The ones you need to act on — a lapsed certificate, a new serious issue, a large score drop, or a site we could not read — are also emailed to the store's owners and admins from Torva's own address, at most a few a day. Switch that off under Settings → Email & notifications → Compliance alerts.

What happens next

Once your open issues are clear, rescan. A clean scan earns Torva Verified and the badge becomes available on this page. From then on the weekly check runs on its own: most weeks you will hear nothing, which is the point. When something does change — you add a product, edit a description, or switch theme — an alert appears here with the issue and its fix, before a payment processor finds it.

Common problems

"We could not reach your site." Your score and certificate are left exactly as they were; an unreachable site is never scored down. If your domain sits behind Cloudflare bot protection or a firewall of your own, allow requests identifying as TorvaPreview/1.0.

Your products were not checked. The report says so under what we could not check. This usually means the catalog is behind a login or a research gate the scan could not pass. Tell us and we will look at scanning it with your access.

The score did not move after a fix. Rescans are hourly and the page shows the last check's result until a new one finishes. Check the date under the dial.

Your certificate says lapsed. A weekly check found something critical or serious. Fix what the report lists and rescan; the first clean scan puts it back to verified.

Related

• Your domain has to be active before monitoring starts. Settings → Domains is where that happens.
• The public certificate lives at a torvaos.com address and is safe to link from your footer; the badge code on this page is the markup for it.