# Research-Chemical Store — AI Agent Compliance Brief **How to use:** paste this entire file into your AI coding agent (Claude Code, Cursor, etc.) and point it at your storefront. It is an honest remediation brief: every step makes the site a *more accurate* representation of a research-reagent supplier and keeps it processing. It is not cloaking — see the rule below. --- ## The one idea that matters most Payment processors monitor merchants with an **automated crawler**. Most compliance advice tells you to perfect your page copy so the crawler reads you as clean. That is line two. **Line one is making sure the crawler never reads your catalog at all.** The stores that keep processing six figures on this category put a **content-neutral human-verification gate in front of the entire storefront.** The crawler hits the gate, sees nothing, and has nothing to flag. Your job is to build that gate first, then keep the inside reasonably clean for the rare moments a *human* looks (manual review, test purchase, chargeback, a COA). **This is access control, not cloaking.** You serve the *same* gate to every visitor — human or bot. You do **not** detect the processor's crawler and feed it a different, sanitized page. Crawler is denied, not deceived. That line is non-negotiable: same experience for everyone = allowed; different content for the crawler = a violation. --- ## Priority order (do them in this order) 1. **Gate the crawler out** — the dominant lever. 2. **Mask the drug-class names** behind the gate + keep research-use, legal, and attestation in place. 3. **Route the highest-risk compounds off your primary card processor** where feasible. 4. **Then** clean the page content (everything in DO #4–#6). This is insurance, not the gate. --- ## DO ### 1. Build the access gate (highest priority) - **This must be a FULL-SITE gate, not a pop-up.** The single most common mistake: a CSS/JavaScript modal layered *on top of* a fully-rendered storefront. That does **nothing** — the product names, prices, and JSON-LD are still in the HTML response, so a bot (or anyone running `curl` / view-source) reads straight past the modal and scrapes everything. The catalog markup must **not be present in the initial HTML response at all** until the visitor passes. - Implement it one of these ways (in order of strength): 1. **Edge / server interstitial** — Cloudflare (Bot Management + a managed challenge / Turnstile) or a server route that returns the **gate page only** for an unverified session, and the storefront **only after** a verification cookie is set. This is what the long-lived reference stores do: a bot gets an HTTP 403 or a `Bot Verification` challenge page, never the catalog. 2. **reCAPTCHA Enterprise** full-page interstitial that withholds the app until solved. 3. If you can only do client-side: serve a **gate-only HTML document** and **fetch the storefront markup separately, injecting it into the DOM only after the gate passes** — so the entry URL's HTML contains the gate and nothing else. (Better than a modal, weaker than edge-level.) - After the bot check, present a **research-access attestation**: "I am 21+", "I understand these are for research use only and not for human consumption," and a researcher-type selector (Private Research / Laboratory / Academic). Log it. - Apply the gate **uniformly to all visitors and all user-agents** — never branch on whether the visitor looks like the processor's crawler (that would be cloaking). - **Gate every route, not just the homepage** — product pages, the catalog, and COA URLs must all sit behind it. A crawler that finds a deep product URL must hit the gate there too. ### 2. Mask the regulated drug-class names - **Never spell out INN or brand drug names** anywhere a crawler can read them: `semaglutide`, `tirzepatide`, `retatrutide`, `cagrilintide`, `Ozempic`, `Wegovy`, `Mounjaro`, `Zepbound`. - Replace them with **neutral house codes** (e.g. `RP-100`, `RP-300`, or a `GLP-x`/internal series) across **every surface**: product title, on-page text, URL slug, `` and meta description, Open Graph tags, image alt text, image filenames, JSON-LD, **and the COA filename + the COA document itself**. - Keep the internal mapping (code → compound) in a private reference, never in crawlable HTML. ### 3. Keep research-use, entity, and legal in place - A **research-use-only (RUO) line** on the header/footer, every product page, cart, and checkout: *"For laboratory research use only. Not for human or veterinary use. Sold only to qualified researchers and institutions."* - An **FDA disclaimer** (not a drug/supplement/cosmetic; not FDA-approved to diagnose/treat/cure/prevent). - A **real legal entity** (name + address + phone) and a **full legal stack**: Terms (with a real governing-law state, venue, arbitration + class-action waiver, and a no-resale / not-for-human-use clause), a **Privacy Policy** (publicly accessible, with CCPA/CPRA + retention + data-rights), Shipping, and Refund policies. - A **logged researcher attestation at checkout**. ### 4. Make products read as reference materials - Per product: **CAS number, molecular formula, molecular weight, purity (e.g. ≥99% HPLC), appearance, storage.** - A **named third-party lab** + a **Certificate of Analysis** per lot, and an **SDS** link. - Describe each item as *"a synthetic reference material supplied for in-vitro laboratory research"* — no benefit, mechanism, dosing, or human-use language. ### 5. Route the prohibited class off the main rail - For the highest-risk compounds (the GLP/INN drug analogs), **process them on a separate payment rail**, not your primary card processor. Naming alone doesn't make a prohibited compound permitted. ### 6. Remove the disqualifying content - No **dosing, titration, reconstitution-for-use, "how to inject," cycles, or protocols.** - No **weight-loss / fat-loss / appetite / "lose X lbs"** language; no **disease claims** ("treats obesity," "reverses diabetes"). - No **before/after** images or transformation testimonials. - No **star ratings, review counts, or "verified buyer" widgets** (fake-review-rule + wrong-category signal). - No **pharmacy-price comparisons** ("$1,349 at the pharmacy → $89"). - No **"FDA Approved" / "FDA-Registered Facility"** or other implied-endorsement claims. - No **human dosage forms** in product specs ("Injections USP," "oral capsules/tablets," "injectable pen," "subcutaneous"). - No **"discreet / unmarked / generic-label packaging"** sold as a feature. --- ## NEVER - **Never rely on a pop-up / modal gate.** If `curl`-ing your storefront URL (or "View Source") returns your product names and prices, your gate is decorative — the bot ignores the modal and crawls everything. The content must be withheld from the HTML response, not just visually covered. - **Never cloak.** Do not serve the processor's crawler different HTML than humans. The gate must be identical for everyone. - **Never spell out** an INN or brand drug name on any crawlable surface (including `<title>`, meta, alt text, filenames, COA filename, JSON-LD). - **Never fabricate** a CAS number, molecular weight, lab name, or customer review. - **Never keep** dosing, human-use, weight-loss, or disease content "for conversion." --- ## Hidden surfaces to check (people forget these) The crawler reads more than visible copy. Purge drug names + claims from **all** of: `<title>` · meta description · Open Graph tags · URL slugs · image alt text · image filenames · **COA filenames and the COA PDF itself** · JSON-LD / product schema · sitemap.xml · "frequently bought together" bundles (don't auto-assemble a recognizable drug stack). --- ## Definition of done (acceptance checklist) - [ ] **Access gate live** in front of all routes: bot-verification interstitial + research attestation; automated/non-browser requests get nothing; same gate for every visitor. - [ ] **`curl https://yoursite/` (and every product/COA URL) returns the gate, NOT product names/prices/JSON-LD.** If the catalog is in the HTML response, the gate is a pop-up and has failed — fix this before anything else. - [ ] **Zero spelled-out INN/brand drug names** in copy, `<title>`, meta, slugs, alt text, filenames, COA filename, JSON-LD, sitemap. - [ ] RUO line on every product page + header/footer + checkout; FDA disclaimer present. - [ ] Real entity + Terms (governing law, venue, arbitration, no-resale) + **public Privacy Policy (CCPA)** + Shipping + Refund. - [ ] Researcher attestation logged at checkout. - [ ] Every product: CAS + formula + MW + purity + storage; COA (lab named) + SDS. - [ ] Highest-risk INN class routed off the primary card processor. - [ ] No dosing / weight-loss / disease copy, before/afters, star reviews, pharmacy comparisons, "FDA approved," or human dosage forms. --- ## Why this works (and its limits) The gate stops the **automated crawler** — the thing that flags most merchants. It does **not** stop a human underwriter who solves the gate, a test purchase, a chargeback, or the COA that states the true compound. So build **both**: the gate keeps you off the daily automated radar (line one); the masked names, RUO, legal stack, and reagent framing keep you defensible the day a human actually looks (line two). *This is a business-compliance brief, not legal advice. Confirm catalog-specific FDA status and any litigation posture with regulatory counsel.*