Evidence before claims
How CROtrustify measures storefront trust
A transparent account of what the scanner observes, how scores are calculated, where AI is used, and what the results cannot prove.
Maintained by
CROtrustify Research Team
Current version
ctr-v2.1-2026-08-15
Released
15 August 2026
What the audit observes
CROtrustify visits publicly available storefront pages using a browser. It does not enter Shopify Admin, read private analytics, inspect orders, or observe real customer sessions.
The scanner starts with the homepage and, when discovery succeeds and the selected plan permits it, evaluates product and checkout or cart paths. A separate mobile capture measures rendered usability at a phone viewport.
Evidence includes visible policies and contact routes, delivery and return clarity, payment reassurance, social proof, link integrity, security headers, accessibility indicators, performance measurements, mobile layout, and visual hierarchy.
How the Trust Score is calculated
Each evaluated signal receives 0 (critical), 1 (weak), or 2 (good). Signals are normalized to a 0–100 category score. A category containing a critical signal cannot be presented as passing, even when its average would otherwise be high. Category scores are then combined using the weights below.
| Category | Weight |
|---|---|
| Trust & Security | 30% |
| Shopping Transparency | 15% |
| Logistics & Returns | 15% |
| Contact & Legitimacy | 15% |
| Social Proof | 15% |
| Visual Credibility | 10% |
Missing evidence is not silently converted into a positive result. Coverage can vary when a page is unavailable, protected by a bot challenge, or cannot be discovered safely.
Deterministic checks
Code-based checks evaluate observable markup, links, headers, rendered geometry, policies, page states, and other repeatable technical evidence.
AI-assisted interpretation
AI can help interpret visual or contextual evidence and improve explanations. It does not create behavioral data, prove causation, or replace a controlled experiment. Findings remain constrained to evidence captured during the scan.
Rules for aggregated research
Operational audit totals are not automatically treated as an independent research sample. Before CROtrustify publishes aggregated findings, the cohort must follow these rules:
- Include completed scans only and exclude blocked, failed, test, internal, or example domains.
- Use one latest eligible scan per normalized domain so repeat customers are not counted as separate stores.
- Compare only scans produced by the same methodology version and with the required page coverage.
- Label a cohort Shopify-specific only when strong public storefront evidence identifies Shopify.
- Publish the date range, sample size, inclusion rules, exclusions, and definitions beside every result.
- Report only anonymized aggregates; do not identify a store or expose contact, account, or scan-level data.
Limitations
A Trust Score is a diagnostic summary of observable storefront evidence at one point in time. It is not a conversion-rate forecast, revenue estimate, legal opinion, security certification, accessibility conformance audit, or guarantee of commercial performance.
Themes, apps, experiments, location, cookies, login state, bot protection, and third-party services can change what the scanner can observe. Merchants should verify important findings and measure implemented changes in Shopify Analytics or another first-party analytics system.
When the scoring methodology changes, the version changes too. The first scan under a new version becomes a new baseline; CROtrustify does not issue decay alerts by comparing incompatible versions.
See the evidence on your own storefront
Run an audit, then verify each finding against the captured page.