Screen the order before you ship it.
Keep the proof that you did.

Billing, shipping, customer and company names available on an order are normalized for spelling and punctuation, compared against aliases, and weighted with country or city detail when both sides carry it.

• Screening starts from Shopify order and customer events — no manual paste, no spreadsheet.
• Word-order tolerant, phonetic and transliterated comparisons surface spelling variations.
• Date of birth, country and city raise or lower confidence when both records contain them.

Sources are selected per store in Settings, in three groups, so a merchant can screen against the jurisdictions that actually apply to it.

• Global and major jurisdictions: US OFAC SDN and Consolidated, EU Consolidated Financial Sanctions, UN Security Council Consolidated, UK OFSI Consolidated, Switzerland SECO, US BIS / Trade.gov Consolidated Screening List.
• Additional country lists: Australia DFAT, Canada Consolidated Autonomous, and national lists for Belgium, France, the Netherlands, Czech Republic, Estonia, Latvia, Lithuania and Poland.
• Other US risk lists: US State Department state-sponsor and terrorist-exclusion lists, and US SAM Exclusions — labeled in the app as federal debarments, not sanctions.

Country risk is evaluated by the same maintained MatchAudit service the main product uses. A BLOCK result is shown as embargoed and a CAUTION result as restricted; both hold fulfillment for human review.

• Inputs include FATF Call for Action and Increased Monitoring, EU AML high-risk countries, Transparency International CPI, World Bank Rule of Law, MatchAudit jurisdiction profiles, territorial and sectoral sanctions, currency nexus and source freshness.
• Settings can add stricter merchant country rules: embargoed and restricted hold fulfillment, watch records evidence only.
• A merchant rule can only tighten the shared evaluator's result. It cannot weaken it.

Every case shows how the score was reached in plain language, cites the public-list record and the dataset version behind it, and sits next to the country result and the party's Directory status.

• Three thresholds: Conservative flags more possible matches, Balanced is the default, Strict flags fewer names and can miss broader spelling variations.
• The score is a review signal, not proof that two people are the same.

A flagged screening places a MatchAudit hold on eligible fulfillment orders so goods do not leave while the match is open. Releasing the hold is a deliberate human action inside Shopify Admin.

• Allow releases the MatchAudit hold; Keep blocked leaves it in place.
• MatchAudit never cancels, refunds or edits the order itself.

For each flagged screening the app prepares a plain-language ALLOW or BLOCK recommendation and a proposed rationale, written for a merchant rather than a sanctions specialist. The merchant can edit the text before saving it.

• Deterministic rules override any unsafe suggestion: missing source data, unavailable country risk, a BLOCK or CAUTION country result, an existing Directory restriction, or an exact or strong sanctions match can never be shown as safe to allow.
• AI cannot release a fulfillment hold. A Shopify staff member must press the button.
• Customer names, addresses, Shopify identifiers and tokens are not sent to the model — only roles, countries, deterministic score components, source and version metadata, and public-list evidence.

A missing reader connection, missing source coverage, a stale canonical version or a query failure never produces a clear result. The order opens a manual-review case and takes a hold instead.

• A historical case without a completed sanctions result is labeled Not evaluated — never 0 matches.
• Retry failed checks re-runs a corrected screening against current shared data at no charge and without consuming the store's allowance.
• Duplicate open cases for the same Shopify resource are grouped, older cases receive append-only superseded decisions, and one current case remains to confirm.

A persistent, per-store roster of screened customers, billing and shipping parties and companies. Stable Shopify customer IDs are used for deduplication where available; guest-checkout parties are kept by normalized-name hash plus screening role.

• Statuses are clear, flagged, cleared with decision, and restricted — a restricted party holds future orders for review even when the current list comparison is clear.
• Each entity's full screening and decision history is visible, including list sources and country-rule reasons.
• Single-entity and bulk re-screening run as tenant-scoped background jobs against current list snapshots.

Each party can be included in or excluded from recurring monitoring, and new canonical list versions automatically re-screen the Directory for subscribed stores.

• Recurring jobs run weekly on a chosen weekday or monthly on days 1 to 28, in the job's own IANA timezone.
• An optional safety cap limits how many parties one run processes; jobs can be run now, paused, resumed or deleted.
• Snapshot-triggered re-screening is automatic and is not billed as a manual rescan.

One unattended historical screen during onboarding or on demand, over Shopify's Admin GraphQL Bulk Operations API, plus a CSV upload for older or off-platform records. Both use the same matching policy and canonical data.

• Shopify exposes the most recent 60 days of orders by default; the report always prints the effective screened window and widens automatically once the approved read_all_orders scope is granted.
• CSV upload accepts up to 10,000 records or 5 MB, records the file's SHA-256 checksum, and reports received, accepted and rejected row counts. Rejected rows are never described as screened.
• Results are tiered as confirmed evidence, review required, country risk, no match, or incomplete — incomplete is never presented as a no-match.
• Historical results never auto-apply a hold, refund, cancellation or filing. Non-clear records enter a separate retrospective review queue with an append-only action history for false positives, post-dated designations, MLRO escalation, authority report references and documented remediation.

Human screening decisions, policy acknowledgements, periodic reviews and the AI drafts or gap flags shown to reviewers are all captured as records and can be exported over a date range.

• PDF and JSONL date-range exports are stored privately and downloaded through short-lived links.
• A single case can be exported as a private PDF containing the screened parties, sanctions and country-risk evidence, the merchant decision, the fulfillment-hold state, source versions and linked evidence hashes.
• Every decision retains the completed canonical index generation, exact matched-entry hash, matching algorithm version, threshold, country-risk assessment and freshness, timestamp and authenticated reviewer identity.

The app exposes one trigger and two actions so screening fits the automations a store already runs.

• Trigger: Sanctions match found, when a screening crosses the review threshold.
• Actions: Screen order, and Hold fulfilment with a supplied reason.
• Flow actions are not separately metered, though a screening still counts toward the plan allowance. Keep a human review step after any automated hold.

The Shopify app runs on its own database, separate from the main MatchAudit workspace, with per-store isolation enforced in the database rather than in the interface.

• Customer names, addresses, dates of birth and Shopify access tokens are encrypted before storage.
• Reviewer identity is taken from Shopify's verified session token, never from submitted form data.
• Country-risk calls send only shipping country, city or province context and order currency — not names, street lines, postal codes, Shopify identifiers or tokens.
• Retroactive reports use a merchant-selected 7, 30, 90 or 365-day retention, and are deleted at expiry and immediately on uninstall. Shopify customer and shop redaction requests are honoured.