Peptide website requirements: the compliance spec sheet.

Whoever builds your research-peptide store, whether freelancer, agency, platform, or you, this is the specification the finished site has to meet. Not because a regulator hands out a checklist (none does), but because two audiences will inspect the site and each can end your business: regulators reading your marketing, and payment underwriters reviewing your storefront before and after they approve you. Hand this list to your builder and make every item an acceptance criterion.

Language and labeling

• Research-use-only statements on four surfaces. Product pages, cart, checkout, and order confirmations should all carry the research-use / not-for-human-consumption line. One footer disclaimer is not an architecture.
• Zero human-use language anywhere. No dosing guidance, no benefit claims, no before-and-after anything, no brand-name drug comparisons, in product copy, blog posts, emails, and social links alike. Enforcement decisions repeatedly cite the totality of a seller's marketing, not just the label.
• Accurate business identity. Legal entity name, physical address, and working contact information, consistent with your merchant application. Mismatches read as evasion to the people who approve payments.

Gating and eligibility

• Age verification before purchase. Logged with a timestamp, not just displayed. Eighteen is the floor most people build to; a number of operators and platforms gate at 21 instead, which is the more conservative posture and the one underwriters tend to prefer.
• Intended-use attestation at checkout. A recorded confirmation that the buyer is purchasing for research purposes.
• Restricted-state blocking that actually blocks. Jurisdiction rules enforced at checkout against the shipping address, with the restricted list kept in configuration someone maintains, because it changes.

Documentation

• A certificate of analysis for every product, per batch. Named laboratory, lot number, test date, and purity, displayed on the product page and rotated when the batch does. Stale certificates on fresh lots are worse than none; they prove nobody is minding the system.
• Lot-to-order traceability. The back office must be able to answer "which orders received Lot X" quickly. Buyers never see this feature; underwriters and regulators increasingly expect it.
• An audit trail. Age attestations, use attestations, and blocked-checkout events, stored where you can produce them on request.

What underwriters check on the storefront itself

Before approving a high-risk merchant account, a human reviews your site. Beyond everything above, they look for: a published refund and shipping policy, terms of service, a privacy policy, a recognizable billing descriptor disclosure, working contact channels, and pricing that matches what the application claimed. Build these as first-class pages, not links to nowhere. the full underwriting file is its own subject, but the storefront items live in your builder's scope.

Technical floor

• TLS everywhere and no card data touching your server, meaning checkout through a compliant gateway integration, full stop.
• Someone watching production. If a plugin update silently breaks the age gate on Tuesday, who knows by Wednesday? Error monitoring, or a provider contractually responsible for it, belongs in the spec, because a compliance control that fails silently is a control you do not have.
• Mobile performance. The majority of this category's traffic is phones; a store that only performs on desktop fails most of its visitors.

How to use this list

Put it in the contract. Every item above is either delivered, or named as excluded with an owner assigned, usually you. The most expensive words in a peptide website project are "we assumed you were handling that," spoken six weeks after launch, one week after a processor's site review. The spec exists so nothing is assumed.

This is a practical build specification, not legal advice; requirements vary by state and change over time, so confirm regulatory items with qualified counsel. The author runs pep.app, a storefront platform in this category, and that bias is stated openly.