Platform risk8 min read

Who actually bans what: the platform is rarely the problem, your processor is

Merchants in restricted categories spend a lot of time asking the wrong question. The question is not "which platform allows peptides." It is "who actually decides," and the answer is almost never the platform.

We went through the published policies. Here is what they say, with links so you can check every line yourself.

The finding

Most store platforms do not publish a list of banned products at all.

Shopify's Acceptable Use Policy does not enumerate product categories. It says you cannot use Shopify to do anything illegal where you do business, and leaves it there. Squarespace's guidance on what you cannot sell does not list categories either. It tells you to go and read your payment processor's rules.

And when you follow that instruction, the trail gets short fast. Shopify Payments' terms do not contain their own product list. They point at Stripe's list, and at PayPal's.

So for a very large share of online stores, the rule that decides whether you can trade is not written by the company whose logo is on your dashboard. It is written by Stripe.

The exception is Wix, which does publish an explicit list, and names categories directly.

What that means in practice

PlatformDoes it list banned products?Who actually decides
ShopifyNo. The AUP covers legality, not categories.Stripe, via Shopify Payments
SquarespaceNo. It refers you to your processor.Stripe, Square or PayPal
WixYes, an explicit named listWix Payments, on its own terms
WooCommerceNo platform policy exists. It is software you host.Whichever gateway you connect

That last row is the one worth sitting with. WooCommerce is self-hosted, so there is no company that can switch your store off for selling the wrong thing. Your exposure moves entirely to your host and your gateway, which are things you choose and can change. That is a different risk profile, not an absence of risk.

Category by category

This is what the two platforms that publish real lists actually say. Stripe's terms govern Shopify and much of Squarespace; Wix Payments governs Wix.

CategoryStripeWix Payments
Peptides / research chemicalsProhibited where "incorrectly labeled"Prohibited, listed under hazardous materials
Supplements / nutraceuticalsProhibited if unsafe or making harmful claimsProhibited where they contain prescription ingredients or CBD/THC
CBD and hempRestricted, allowed with negligible THC per local limits, extra due diligenceProhibited. Wix Payments does not support CBD or THC at all
THC over the local limitProhibitedProhibited
KratomNot named in the policyNot named in the policy
Vape, e-liquid, tobaccoRestricted, allowed if compliant with local lawProhibited
Firearms and partsRestricted, limited availability, requires contacting salesProhibited
AdultProhibitedProhibited
Gambling and sweepstakesProhibited, narrow charity exceptionsProhibited

Two things follow from that table that are worth more than the table itself.

Stripe is more permissive than Wix Payments, not less. CBD, vape and firearms are all "restricted" with Stripe, meaning approval is possible with extra scrutiny, while Wix Payments refuses them outright. If you have assumed the big platform is the strict one, that is backwards.

"Restricted" is not "allowed." It means a human will look at your business and decide. Building a store on the assumption that restricted means yes is how merchants end up with a finished site and no way to take money.

The trap: not listed does not mean allowed

Kratom appears in neither policy by name. Merchants read that as permission. It is not.

Every one of these policies carries a catch-all. Square's terms, for example, prohibit using the service "for any illegal activity or goods or in any way that exposes you, other Square users, our partners, or Square to harm." A category nobody thought to write down is judged under that clause, by someone at the processor, after you have already been trading.

Which is why enforcement in these categories is almost always by discovery rather than by prevention. Nothing stops you listing the product. There is no filter at upload. The gap between listing it and being found is not compliance, it is just time.

What the platform can do when it finds you

Worth quoting Wix directly here, because it is the most specific and the others are not meaningfully gentler. Wix states it may "hide or delete prohibited products, suspend or close your Wix Payments account, withhold or block funds, and/or refund payments to the relevant customers."

Read the last clause again. Not merely closing the account. Refunding your customers, with your money, after you have shipped the goods.

So what should you actually do

Work out which of two risks you are carrying. Payment risk is your ability to take a card, and it is fixable by changing processor. Platform risk is your ability to keep the store at all, and changing processor does nothing about it. Most merchants only find out these are separate when both fail at once.

Read your processor's list, not your platform's marketing. If you are on Shopify, the document that governs you is Stripe's. Bookmark it.

Get your data out before you need it. Export your catalogue and your customer list today, whatever you decide. A closure costs you a website if you have that export, and a business if you do not.

Assume "not listed" means "not yet decided." If your category is absent from every list, that is not clearance. That is an open question that gets answered on the worst possible day.


Policies checked against the published documents on 28 July 2026 and linked above. They change, and none of them is exhaustive by its own admission. This is a starting point for your own reading, not legal advice.

We place merchants in these categories with processors that approve their specific category, and set up a backup so a single decision cannot take the business offline. If you want to know what you are exposed to before you spend anything, tell us what you sell.