Before you accept the finished store

Acceptance uses the contract you already signed

The scope is the written list of work the implementer agreed to deliver. This page cannot supply that list. Put each delivered item next to a line in that document: done and visible, done with a named defect, or not delivered. A redesign that was only proposed, or a processing change that was sequenced separately, is not part of this acceptance unless the written scope includes it.

Hiring an implementer is an earlier decision. Accepting the work is the later one. Do not treat a polished homepage as proof that checkout, accounts, and handover were finished.

You should hold the accounts, not a screenshot of them

WordPress uses roles to control what a user can do. An administrator has access to all the administration features within a single site. A lesser role does not. Confirm that a user you control has the role the site needs, and that you can sign in without asking the implementer to share a password.

WooCommerce says orders are visible to users with the administrator or shop manager role. If the scope included the store, sign in as a user you control and open the order list. A video of someone else's screen is not the same as your own access.

Stripe's team settings let the account invite members, assign roles, and send those invites by email. Invites expire after 10 days. Stripe says to grant the lowest permission the person needs. That is the handover for a Stripe account: your own user, with a role you understand, not a shared login.

Stripe's API key page says a publishable key may be used in front-end code and cannot create charges or read account data. A restricted key and a secret key are not safe to expose. A secret key has unrestricted permissions, and Stripe says it does not recommend secret keys for new use cases. Ask where live keys are stored, who can reveal or rotate them, and remove any key the implementer no longer needs. Do not paste a secret or restricted key into email or the consultation form.

Visible checkout behavior, without a fake order

For each checkout item in the written scope, record what a visitor can see and what the admin screen shows: the payment method listed, the return page if the scope uses a hosted checkout, and the order status path the platform documents. If the contract requires a test payment, use the provider's own test mode and keep the resulting payment reference. Do not invent an order, a card number, or a buyer to make the sheet look complete.

Stripe says a Checkout success URL is where the customer is sent after a successful payment or subscription creation, and also says you cannot rely on the customer reaching that page to fulfill an order. If hosted checkout is in the scope, the handover should include the success and cancel URLs that were configured and the event the integration uses to record payment. Accepting a page that says the payment succeeded, without that provider record, accepts a screen rather than the integration.

Unresolved defects stay on the list with an owner and a date. Closing them in the acceptance note, while the behavior is still wrong, does not finish the work.

What the final payment covers

Your agreement decides when the work is accepted and when the last payment is due. This page does not add a payment hold or an acceptance rule of its own. It can help you read the agreement before you pay.

• Scope lines: which lines of the written scope this payment closes, and which stay open.
• Revision rounds: how many rounds the agreement included and how many have been used.
• Separate changes: which requests fell outside the scope and were, or still need to be, agreed separately.
• Continuing obligations: hosting, support, licenses, or maintenance that continue after launch, who provides them, and on what terms.
• Account handover: which accounts move to users you control with this payment, named by service.

What acceptance does not decide

You can decide whether the delivered items match the written scope, whether you control the site and payment users, and which defects remain open. The implementer or the host has to hand over access they still hold. The payment provider decides eligibility, price, reserves, and account status. Accepting the website does not open or keep a processing account.

Prism builds research-only stores and can finish an incomplete build once the business's own access to its accounts is confirmed, under its own written scope. A Prism storefront review is a different service: it is informational, and it is not a legal opinion, a compliance certification, or an acceptance certificate for another firm's project. Prism confirms scope, responsibilities, fees, and terms before work begins.

Whether a particular plugin, host login, or domain registrar is included in your contract is unknown until that contract says so. Leave it off the acceptance list rather than assuming the implementer transferred it.

In the consultation request, include a summary of the agreed scope, the visible defects that remain, which accounts the business holds in its own name and which it does not, named by service, and any handover responsibilities still outstanding. Leave out passwords, keys, and customer lists.

Handover comparison

Use the written scope and the accounts you can open. Never enter passwords, secret keys, restricted keys, or other credentials in this worksheet. Record only the authorized role and the name of the secure storage system.

Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.

These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.