Evidencee documentation

How Evidencee connects to Shopify, Stripe, and GoCardless, and what each integration unlocks.

• Platform walkthrough
• Pricing & plan differences

The 19 DMCC controls Evidencee checks, why each one matters, and how the audit score is built.

• The DMCC obligations behind the controls
• How the audit fits into onboarding
• DMCC Act 2024 — full text (legislation.gov.uk)

Renewal and trial-ending notices, timing options, and email-provider configuration.

• Where notices fit in the walkthrough
• DMCC notice requirements

How Evidencee grades the sign-up and cancel step counts you record, what regulators look at, and the hosted-cancellation flow.

• CMA enforcement guidance
• Cancellation parity in the platform walkthrough

Statutory cooling-off windows and case management — Approve a refund and Evidencee sends it through your connected Stripe or GoCardless account — built and tested against a stand-in, not yet run on a live account — or record one you paid yourself; Evidencee logs the reference, date, and proof.

• Cooling-off in the platform walkthrough
• DMCC cooling-off rules

Run daily scans across your Shopify catalogue and your Stripe prices and payment links, and resolve findings where a price component is missing from the up-front total.

• Why drip pricing is a DMCC breach
• How regulators treat drip pricing

Connect your review sources (Judge.me is verified end to end; Trustpilot, Yotpo, Loox, Okendo, Stamped and Google are connected but not yet verified against a live account), run daily scans for bursts of reviews, near-duplicate text, repeat reviewers and ratings that contradict their own text, and mark findings reviewed, actioned or dismissed.

• Fake reviews as a CMA enforcement priority
• Banned commercial practices under DMCC

What the vault records, how SHA-256 payload hashes and the linked chain work, and how to search by subscriber hash, subscription or date.

• Evidence in the platform walkthrough
• CMA enforcement — what regulators ask for

Generating a sealed, self-contained HTML bundle (with embedded SHA-256 hashes and a Merkle root) and verifying evidence integrity.

• Export step in the walkthrough
• Providing bundles to regulators

The five workspace roles (ADMIN, OPS, LEGAL_REVIEWER, VIEWER, AGENCY_MANAGER) and what each can do.

• How agencies use multi-brand workspaces

Workspace defaults, retention windows, and data-protection settings.

• Data retention & privacy
• Data Processing Agreement

Plan comparison, upgrade/downgrade behaviour, and what happens when you change or cancel your plan.

• Plan comparison & FAQ
• Cancellation & data retention (Terms)

On Enterprise, connect your own systems to Evidencee. A read-only REST API (bearer-key auth at /api/v1, 120 requests/min per key) lets you pull evidence events, notices, cancellations, brands and usage. Outbound webhooks POST an HMAC-signed payload to your URL as notices, cooling-off cases, cancellations reported by your payment provider and other evidence events are recorded — with automatic retries and a delivery log. Cancellations made on your hosted cancellation page are not sent yet. Subscriber data is always hashed or masked, never raw.

• Create & manage keys (Developers)
• Available on Enterprise