Store Trust Network
The Store Trust Network lets a merchant who runs more than one WooCommerce store link the stores they own, so a customer who racks up return abuse or chargebacks at one of your stores is recognized at the others. It is a Pro, multi-site feature, opt-in, and off by default. This page explains what the network is — and, just as importantly, what it is not — how the cross-store matching and scoring work, and the privacy model behind it. For the step-by-step setup and the settings reference, see Store Network Settings.
What It Is — and What It Isn’t #
Read this section first. The Store Trust Network is frequently misunderstood, and the distinction matters for both accuracy and privacy.
What it is: a private link between the stores you own. You generate one secret group key, paste the identical key into each of your stores, and list each store’s URL. From then on, a risk flag raised about a customer at one of your stores is shared with the others, so a repeat offender is caught even on their first order at your newer store.
What it is not:
- Not a global or public network. Your stores are never linked to other merchants’ stores. There is no shared blocklist across all TrustLens users. The only stores that ever exchange flags are the ones holding your group key.
- Not a central server. Nothing is uploaded to Webstepper or any third party. Each of your stores pulls flags directly from the other stores you listed, over their own WordPress REST endpoints. TrustLens is not in the middle.
- Not a sharing of customer identities. Names and email addresses never leave a store. Only an irreversible keyed hash, a flag level, and a short reason slug are exchanged — see Privacy and Security below.
If you run a single store, there is nothing to link, which is why the feature requires a multi-site license (see Requirements and Availability).
Who It’s For #
The Store Trust Network is for merchants who operate two or more WooCommerce stores under common ownership — for example:
- A primary brand and a spin-off or sub-brand on a separate install
- Regional storefronts (US / EU / UK) running as independent sites
- A flagship store and an outlet or clearance store
- Several niche stores run by the same operator
The common thread is that the same customer can shop across your stores, and a customer who is abusing returns or filing chargebacks at one is likely to do the same at another. The network closes the gap so that history follows the customer across the stores you control — without each store having to rebuild it from scratch.
Requirements and Availability #
| Requirement | Why |
|---|---|
| TrustLens Pro | The network module ships only in the Pro build. |
| A multi-site (or unlimited) license | A single-site license has no sibling stores to link, so the feature is gated to multi-site and unlimited plans. |
| Opt-in toggle on + a group key set | The network does nothing until you switch it on and configure a key. Off by default. |
What free and single-site users see. On the Free build, or on a Pro license that is single-site, the Settings → Integrations → Store Network screen shows a promotional overview rather than the working form. It explains the feature and the multi-site requirement; no key field or sync controls are rendered. Upgrading to a multi-site Pro plan unlocks the live settings. See Free vs Pro Features and the Pricing and Licensing FAQ.
How It Works #
The Group Key and the Hash #
The group key is a single secret string — a 64-character random key generated once and pasted into every store you own. It does two jobs:
- It defines the group. Only stores holding the same key can recognize each other’s flags. Two of your stores with matching keys are linked; a store with a different key (or no key) is not part of the group.
- It keys the customer hash. When a flag is raised or looked up, TrustLens computes an HMAC-SHA256 of the customer’s normalized (lowercased, trimmed) email address, keyed with the group key. The result is a 64-character hex hash. The same email produces the same hash at every store that shares the key, which is what lets the stores match a customer — without any store ever seeing another store’s customer emails.
This network hash is deliberately separate from the per-store email hash TrustLens already uses internally. Configuring the network does not touch, re-key, or expose your existing customer records.
Background Sync — Fail-Open by Design #
Each store pulls its peers’ flags on a background hourly schedule and stores a local copy in its own table. Checkout-time scoring always reads that local copy, never a live remote call. The consequences:
- Checkout is never slowed. Scoring a customer never waits on a network request.
- Checkout is never blocked by an offline peer. If one of your stores is down, slow, or unreachable, the sync simply skips it for that round and retries on the next hour. This is fail-open: a network problem never prevents an order. Each peer request uses a short timeout (1.5 seconds), and any error is swallowed.
- Flags propagate within the hour. A flag raised at Store A is pulled by Store B on B’s next hourly sync (or immediately if you click Sync now on Store B).
Each sync pulls only the peer’s flags that changed since the last successful pull (the first pull goes back 30 days), and flags that haven’t been updated for 90 days are pruned automatically.
Scoring Penalties #
When TrustLens scores a customer, the Store Trust Network module looks up that customer’s group hash among the flags pulled from your peers. If one or more peers have flagged them, the module applies a negative signal using the most severe level found:
| Peer flag level | Signal reason on the customer profile | Default penalty |
|---|---|---|
| High | “Flagged high-risk at a linked store” | −35 points |
| Caution | “Flagged for caution at a linked store” | −15 points |
Both penalties are configurable (0–50 points) on the settings tab. The penalty is subtracted from the customer’s 0–100 trust score like any other signal — see How Trust Scoring Works and Signals Explained. The flag is visible in the customer’s signal breakdown so you can always see why a score moved.
What Makes This Store Share a Flag #
Sharing is one-directional per event: this store writes its own flag about a customer when one of two things happens, and only while the Share my flags toggle is on (it is on by default):
- A chargeback or dispute is recorded against the customer and is still open or was lost → this store shares a high flag. A chargeback is first-party evidence, so it is always shared. (A dispute you won doesn’t count.)
- This store’s own scoring moves the customer into the Risk or Critical segment → this store shares a caution flag (Risk) or a high flag (Critical). See The Six Customer Segments.
The segment trigger has an important guard: a flag is shared only when the customer has a genuine first-party negative signal from this store (returns, coupons, chargebacks, and so on). If a customer landed in Risk purely because a peer flagged them, this store will not re-share that flag. That prevents a feedback loop where one peer’s flag bounces around the group and double-penalizes the same customer.
Allowlisting a customer at this store withdraws this store’s flag for them.
First-Order Protection #
TrustLens normally holds off on fully scoring a customer until they have a minimum amount of order history at your store (“thin-data” protection, to avoid judging brand-new customers on too little information). The Store Trust Network overrides that in one specific case: if a linked store has already flagged the customer, that is confident external evidence, so TrustLens scores them in full on their very first order at this store rather than waiting for local history to build. This is how a repeat offender is caught the first time they appear at your newer store.
Privacy and Security #
The network is built so that linking your stores never means sharing your customers’ identities.
- Only three things are ever exchanged per flag: the irreversible keyed hash of the email, the flag level (
cautionorhigh), and a short reason slug (e.g.chargeback,risk_segment). Names, email addresses, order contents, and order values are never transmitted. - The hash is one-way. It is an HMAC-SHA256 keyed with your secret group key. A peer store cannot reverse it back to an email, and a store outside your group cannot compute matching hashes at all.
- The group key is never transmitted. When one store pulls flags from another, it authenticates by signing a fresh timestamp with the group key (HMAC-SHA256) and sending only the signature. The receiving store verifies the signature and rejects anything outside a short replay window (about five minutes of clock skew). A request with a missing, wrong, or stale signature is rejected.
- Your existing data is untouched. Configuring or disabling the network does not change your per-store customer records, scores, or the per-store hashing TrustLens already uses. The network is an additive signal layered on top.
For your store’s overall privacy and GDPR posture, see Data and Privacy and the Privacy and GDPR FAQ.
What It Doesn’t Do #
- It doesn’t block customers by itself. A peer flag lowers the trust score and can drop a customer into a lower segment; whether that results in a block depends on your own enforcement settings. See Blocking and Allowlisting.
- It doesn’t link stores you don’t own. Anyone you give the group key to becomes part of the group, so treat the key as a secret you only share with your own stores.
- It doesn’t match across different emails. Matching is by email hash. A customer who uses a different email at each store will not be matched on email alone (per-store linked-accounts detection still applies locally).
- It doesn’t replace your per-store modules. It complements them — the local detection modules still run exactly as before.
Setting It Up #
All configuration lives on the TrustLens → Settings → Integrations → Store Network screen: generating the group key, enabling the network, listing your store URLs, the share toggle, the penalty fields, and the live sync-status panel. The full walkthrough, field reference, and troubleshooting are in Store Network Settings.
Updated on October 18, 2026
