Shipping Contract Guard for WooCommerce

Shipping Contract Guard turns important WooCommerce shipping results into repeatable, manager-approved checks.

Start with one shipping promise. For example, if free shipping begins at EUR 75, the plugin checks synthetic carts immediately below, exactly at, and immediately above that boundary. You review the methods and prices WooCommerce returns before saving anything. Later checks compare against that approved version; current behavior is never silently treated as the new baseline.

Local mode is free and requires no account:

• protect supported WooCommerce core Flat Rate, Free Shipping, and Local Pickup boundaries;
• protect an exact public result returned by another configured shipping method after approving the disclosed quote behavior;
• run invented carts without creating a checkout, customer, or order;
• distinguish Everything works, Problem found, and Could not verify;
• review finite coverage, recent changes, and likely affected approved checks;
• keep 90 days of bounded local history and export JSON, CSV, or a human-readable assurance report; and
• preview and apply one exact core-method availability change with full-contract verification and automatic rollback;
• capture and restore one exact passing core-method state; and
• activate an expiring local continuity path with verified restoration.

Operator is an optional EUR 29/month service for one store. It adds scheduled and post-change checks, independent missed-run supervision, email alerts, minimized offsite evidence, an accountable incident, and verified recovery. A successful checkout page never grants access; only verified billing events and a fresh signed site policy authorize paid work.

Deliberate limits

Coverage is finite. Unsupported methods, unsafe scenarios, incomplete calculations, and ambiguous evidence remain Could not verify. Shipping Contract Guard does not claim that every checkout path is covered or that a preceding configuration change caused a failure.

Core suggestions use only public WooCommerce configuration. Provider-agnostic promises use WooCommerce’s public returned-rate boundary. The plugin never reads carrier credentials or private provider settings. An explicitly approved public-rate check may cause the configured method to make its ordinary quote request for the invented cart and destination.

The plugin does not create orders, submit checkout, process payments, buy labels, contact shoppers, or grant remote control over shipping. Its guarded write boundary is limited to the enabled state of one explicitly previewed WooCommerce core Flat Rate, Free Shipping, or Local Pickup zone-method instance. Prices, thresholds, destinations, zone order, products, coupons, provider settings, orders, payments, and labels remain outside that boundary.

External services

Configured shipping-rate services

When a manager explicitly approves a public-result preview or later check, WooCommerce calls the enabled shipping methods for that synthetic cart. A configured method may send the invented destination, measurements, or product attributes needed for its ordinary rate quote to its own provider. Shipping Contract Guard does not inspect that provider’s settings or credentials. Review the provider’s privacy terms before approving the calculation.

Optional Shipping Contract Guard Operator

The plugin makes no Shipping Contract Guard service request until a WooCommerce manager accepts the fixed disclosure. Starting Operator generates an opaque site-bound checkout reference and private signing key locally, then opens Stripe-hosted checkout. The private signing key never goes to Stripe. Verified Stripe subscription and invoice events, not a redirect, establish entitlement.

After pairing, the plugin contacts https://api.shippingcontractguard.com to pair or revoke the site, rotate its public signing identity, retrieve signed policy, configure the selected schedule and alert email, deliver minimized signed run evidence, retrieve current supervision state, and update a manager-submitted incident handoff.

Transfers can contain opaque site, contract, run, and case identifiers; a public signing key; timestamps and nonces; configuration fingerprints; pass, fail, unknown, and completeness states; supported boundary kinds and core method classes; hashed method-instance identities; bounded amounts and currency; error codes; and bounded configuration-change facts. A submitted incident can also contain acknowledgement, an operational owner label, and a bounded note. Do not put customer data, credentials, or secrets in those fields.

The connector excludes products, raw destinations, customers, orders, payment details, merchant payment-processor data, and carrier credentials. The service retains evidence according to the subscribed plan, initially 90 days. Disconnecting stops new paid work and transfer. An organization owner can export data or request deletion; deletion remains cancelable for 24 hours before tenant records are purged, apart from a minimal replay-protection tombstone.

Privacy policy: https://shippingcontractguard.com/privacy.html

Terms: https://shippingcontractguard.com/terms.html

Stripe privacy policy: https://stripe.com/privacy

Privacy

Local data includes approved contract definitions, synthetic case results, configuration fingerprints and bounded change facts, run timestamps, local operational decisions, and optional service state. Completed local runs are retained for up to 90 days and 500 records. Deactivation preserves data. Uninstall preserves data unless an administrator explicitly enables delete-on-uninstall.

The plugin adds suggested text to Settings > Privacy. Use invented test products and destinations; never enter customer data, credentials, or secrets. A privacy-safe diagnostic download contains only versions, schema and scheduler state, connection presence, and aggregate latest-run counts. Optional WooCommerce logging is off by default and records only an admin action name plus success or error outcome.