Exporting compliance evidence for a review

When a payment processor, bank, auditor or business partner asks how your compliance controls work, the most useful thing you can send is a short, organized evidence pack. It should say what period and which store it covers, describe the controls that were in force, include the records that show those controls operating, and state plainly what the evidence does not show.

This guide walks through each part, with a checklist to run before you send anything.

Start with the request

Read the request twice before you gather anything. Note:

• Exactly what is being asked for, in the requester's own words.
• The period it covers, and whether it concerns specific orders.
• The format and channel they want. Stripe's support pages, for example, say supporting documents are uploaded through the Dashboard.
• The deadline, if one is given. Stripe asks that requested documents be submitted promptly to avoid delays.

Answer the question you were asked. Sending everything you have can bury the answer, and it shares more of your customers' data than the review needs. If the request is unclear, ask for clarification in writing. Responding to a processor information request covers the wider process.

Set the scope and date range

• Which business and site. Name the legal entity, the trading name and the domains covered.
• Which period. Use the date range in the request. If you include anything outside it, say why.
• Which records. All orders in the period, a defined sample, or specific orders the requester named. If you send a sample, explain how it was chosen.

Put this on a cover page so the reader knows what they are looking at before they open anything else.

Describe the controls in force

A reviewer needs to know what your controls were during the period, not just what they are today. Summarize:

• Your compliance profile. Who you sell to, what you sell and on what terms.
• Site-entry checks. What visitors were asked to confirm, and the wording used.
• Checkout checks. What buyer information was collected and checked, and what happened when a buyer did not fit the profile.
• Signed statements. Each statement version in force during the period, with its effective dates. See versioning your policies and checkout statements.
• Hold rules and reviews. Which orders were held and who reviewed them.
• Monitoring. How often you check product pages, policies and checkout copy, and how findings are handled.
• Roles. Who could change settings, who could approve orders, and how admin actions are logged.

If any control changed during the period, give the date and say what changed.

Include the records

• Order-level records for the scope you set: buyer checks, signatures, holds and decisions, payments, refunds and disputes.
• A full listing in a format the reviewer can sort and filter, such as CSV, alongside a readable summary.
• Supporting documents the requester asked for. Stripe's support pages list documents such as itemized invoices, bank or processor statements, and supplier purchase orders or shipment tracking numbers for physical products, and say business details on them should match the information on your account.

Do not edit records for the pack. If something needs explaining or correcting, add a separate note that says so. Building a compliance audit trail covers how to keep records in a state where this is easy.

Organize it so a reviewer can follow it

Stripe's guidance for dispute evidence is written for card issuers, but it describes what any reviewer wants. It recommends presenting evidence in chronological order, grouping it by type, including brief summaries of what each piece shows, and making sure all text and images are legible. It also advises including only the relevant section of a long policy rather than the whole document. Stripe's document guidance adds that files should be clear and large enough to read, and that information spanning several pages should be combined into one PDF.

A simple structure works well:

1. Cover page: scope, date range, what is included and who prepared it.
2. Summary of controls in force, with change dates.
3. Records, grouped by type.
4. Supporting documents.
5. Limits and known issues.

State the limits honestly

This section matters most to a careful reviewer, and it is the one most often left out.

• Self-declarations are declarations. If buyers confirmed their status by declaring it, say so. Do not describe it as verification.
• Coverage. Say what the pack does not cover, such as sales channels outside your store or posts by third parties.
• Known issues. If you found problems during the period, describe them and what you did about them.
• Precise language. Describe a tamper-evident record as tamper-evident, not tamper-proof. See tamper-evident records, explained.

Stripe's credit review guidance encourages detailed answers with supporting documents. Detail and candor work together: a pack that admits a gap is more credible than one that claims to have none.

Checklist before you send

• The cover page states scope, date range and contents.
• Every control described was actually in force for the whole period, or its change date is given.
• Business details match what the processor has on file.
• Files are legible, named clearly and combined where the requester asked.
• Customer data is limited to what the request needs.
• Limits and known issues are stated.
• Someone other than the preparer has read it, where possible.

Keep a copy

Keep an exact copy of what you sent, with the date, the recipient and the channel. If questions follow, you need to know precisely what the reviewer has in front of them.

Exporting from Claddr

In Claddr, you pick a date range and export. The PDF summarizes the controls in force, including the compliance profile, gate settings and statement versions. The CSV lists every recorded entry with its hash. Bank statements, invoices, shipping records and supplier documents come from your own systems. An export describes your controls; it does not decide the outcome of a review, which is always the reviewer's call. How Claddr's audit record works has the detail.