Choosing a peptide store platform

A store platform is more than a theme and a checkout. Under every research peptide store sits a stack of decisions somebody else made: what you are allowed to sell, how your catalog is shaped, where your rules are checked, who owns the address and the data, and what the AI is allowed to do on its own. You live with those decisions every day, and the expensive ones are hard to see on a feature page.

This guide walks the stack from the bottom up, five questions in all. Where it talks about other platforms, it quotes their own pages, dated, in the sources at the foot. We make a platform too, so the scorecard at the end works on any of them, ours included.

Press a layer to see the question it raises, then jump to it. Steps with a Watch button play the same moment in the video.

A store builder and the payments that come with it have separate rules, and it is usually the payments side that draws the line. Some name peptides and research chemicals outright. Others prohibit “pseudo-pharmaceuticals” or incorrectly labeled research chemicals, and leave it to their risk team to decide what fits. Here is what six of them say on their own pages.

A platform that decides it does not want your business can act quickly, and its terms say what happens next. These are the platforms’ own words, not worst cases we imagined.

It can also outlast the account: Shopify’s payments terms say processors report terminated merchants to the card schemes’ lists where the card rules require it, which can make the next provider harder to find.[4] Squarespace can withhold payouts after termination until it judges the risk cleared.[10] And when you close a Shopify store yourself, its data is kept for two years, though its help page does not cover stores Shopify closes.[6]

• Ask the platform, and its payments provider, whether research peptides sold for research use only are allowed. Keep the reply.
• Keep your own copy of your catalog, customers and orders, so a closed account is a bad week and not the end.
• Know where you would take payments next, before you need to.

1. 01

   A catalog model that fits the trade

   Research catalogs have structure a generic product model flattens: several sizes per listing, each with its own price and stock; volume tiers per size, priced in the basket; a limit per order, explained before checkout; the right unit for each listing; and stock counted per batch.

   Ask for: Ask to see one listing with two sizes, tiers and a limit, and where its batches are kept.

   In My-Pepts: Sizes, Bundle & Save tiers, limits per size and stock per batch are part of every listing.

   Watch this step 0:34

   vellmar.my-pepts.store/peptides/research-peptide-avellmar.my-pepts.store/peptides/research-peptide-a/10mg

   

   Own page, own addressSave 15%Limit 5 per orderHurry, only 3 leftStock shown as it is, per size.
2. 02

   Certificates as records, not attachments

   A certificate pasted into a product description goes out of date, covers a batch you no longer sell, or shows for a size it never tested. A platform built for this treats a certificate as a record tied to a batch and the date of its test, shown only when you publish it, and easy to send to a customer who asks.

   Ask for: Every certificate on the store points at a batch you are selling.

   In My-Pepts: Certificates are filed on the batch, their private fields blurred in your browser before they are saved, with independent results beside them.

   Watch this step 0:39

   vellmar.my-pepts.store/admin/testing?tab=coa

   

   99.42% purityFiled on its batchOn the product pageA blurred picture, the full certificate on request. The supplier is never named.
3. 03

   Rules checked when the order is placed

   A minimum order, a delivery charge and a free-delivery threshold are simple ideas. What matters is where they are checked. If only the page knows them, an old browser tab or a crafted request can place an order under rules you have changed.

   Ask for: The rules are settings you change, checked again by the server for every order.

   In My-Pepts: Minimum order, free shipping and free gift thresholds are set in the admin and applied by checkout itself.

   Watch this step 0:42

   Cart subtotal

   $124.97

   Minimum$25Free shipping$80Free vial$120

   Free research vial addedOver $120, packed in the parcel.
4. 04

   Tools that keep your promises for you

   Research use only on every page, a store that stays private until you open it, ad pages that make no claims, ad and analytics tags that wait for consent, and marketing email checked against consent when it is sent. None of it replaces legal advice; it stops the store undoing the policies you wrote.

   Ask for: Nothing the platform does on its own contradicts your research-use terms.

   In My-Pepts: Every page says research use only, a password wall keeps the store private until launch, and campaigns reach only subscribers, checked at send time.

   Vellmar LabsThis store is in private preview.Access password••••••Enter

The rules in a basket are easy to show and easy to skip. Security testers try exactly this on any shop: changing a price or a quantity on its way to checkout, and seeing whether the server notices.[18] The standard advice is that checks in the browser are for the shopper’s convenience, and every value has to be checked again on the server.[19] Raise the minimum order below, then place the order from a tab that still shows the old one.

A platform also decides how much of your day it covers. A storefront that only takes orders leaves you to pack, reply, restock, advertise and email with other tools. Ask how far it goes:

• Packing on a phone, with photos at each step and tracking emailed on dispatch (orders).
• Stock by batch, supplier orders and certificates in one place (suppliers).
• Email from your own domain, sent only to people who agreed (email).

1. 01

   Start on its address, then move to your own domain

   You should be able to open on the platform's address the same day, and connect a domain of your own whenever you are ready, without losing anything on the way.

   Ask for: The domain is registered to you, and connecting it is a couple of records, not a migration.

   In My-Pepts: Every lab starts live on its own address with SSL. Connect your own domain from the Domains page by adding the two records it shows, and the certificate is issued for you.

   Watch this step 0:48

   my-pepts.com/app/domains

   

   Free, from day oneYour own domainvellmarlabs.com is liveDNS verified, SSL certificate issued.
2. 02

   Email from your own address, set up to arrive

   Order confirmations, receipts and campaigns should come from your name, with the records that prove they are yours, so they reach the inbox rather than the spam folder.

   Ask for: Your sending domain passes SPF and DKIM, and publishes a DMARC policy.

   In My-Pepts: Add the records the Email page shows; once the domain is verified, order emails and campaigns go out under your lab's name, from a subdomain that helps keep your main domain's reputation separate.

   Watch this step 0:50

   my-pepts.com/app/email

   

   Your own sending domainVerifiedVerifiedmail.vellmarlabs.com verifiedOrder emails and campaigns now go out under your lab's name.

Order confirmations and tracking only help if they arrive. The big inbox providers now ask more of anyone who sends in volume. Gmail asks every sender for SPF or DKIM and a spam rate under 0.3%, and anyone sending 5,000 or more messages a day to Gmail for SPF, DKIM, a DMARC policy and one-click unsubscribe.[21] Since November 2025 it has stepped up enforcement, rejecting more of the mail that falls short.[22] Yahoo asks bulk senders for the same and to honor unsubscribes within two days,[23] and Outlook has rejected mail from high-volume senders without SPF, DKIM and DMARC since May 2025.[24]

Add the records a My-Pepts lab is asked for, one at a time, and see what each one unlocks.

On a platform, your store sits beside thousands of others. The UK’s National Cyber Security Centre says a provider should make sure one customer’s service cannot access or affect another’s, and be able to explain how.[25] Security guidance for shared software warns that a single vulnerability can expose every customer’s data at once.[26] Press the button below to see the difference.

Every My-Pepts lab runs on its own address, with its own database and its own admin, so a problem in one store is designed to stay in that store.

A platform you cannot leave is one you cannot argue with. Before you sign, find out how you would take your catalog, customers and orders with you, and how long the data stays after an account closes. Then take a copy now and then, whether you plan to leave or not. On My-Pepts, a read-only key for your own tools reaches your catalog, orders and customers, so you can take a copy whenever you like.

1. 01

   AI that drafts, and waits for you

   AI is genuinely useful here: a reply drafted with the order and certificates in view, a supplier's quote read into a stock order, a campaign written from the products you picked. What matters is that it stops at a draft.

   Ask for: Nothing is sent, ordered or changed until a person presses the button.

   In My-Pepts: Claude drafts replies, campaigns and stock orders from your own data, and every draft waits for you. Prices always come from your catalog, never from the AI.

   Watch this step 0:55

   B-0012

   B-0012

   B-0009

   Prepared photo

   Reply to Nadia BrooksDraft

   Hi Nadia,

   Your order PEP-2AC5V5 was packed this morning and goes to USPS today.

   Tracking: 9400 1112 0254 7340 1188 62

   Vellmar Labs

   Read it, edit it, then send.Send

The risk with AI that acts on its own has a name in security circles: excessive agency, where a tool does damage because a model’s output was wrong, ambiguous or manipulated. OWASP’s advice is to give it only the permissions it needs and to require a person to approve high-impact actions before they happen.[27] The UK government’s AI playbook goes further: AI output should not automatically lead to actions like sending email or changing records, and a person should review them.[28] Switch the mode below to see the difference.

Sooner or later you may want your own scripts or an AI assistant to work with your store, perhaps through the Model Context Protocol, an open standard for connecting AI apps to tools and data, whose specification tells apps to get a person’s explicit consent before using a tool.[30] Whatever connects, the key it uses should reach your store and nothing else, and every request should be checked against what that key may touch: the first item on OWASP’s list of API risks.[29]

On My-Pepts, an owner or admin makes and revokes keys on the Connectors page. A key is read only or allowed to make changes, can be limited to some areas and given an end date, acts as the person who made it, and stops working when that person is no longer an admin.

Ten questions, three of them deal-breakers. Answer them for a platform you are considering, then copy the list and send it to its sales team: a good platform will be glad to answer in writing.