Storefronts For The Categories Everyone Else Turns Down
Some products are perfectly legal to sell and nearly impossible to sell online. Platforms remove you, processors review you, and ad reviewers reject you. We build and run the entire operation for brands in exactly that position: the storefront, the compliance layer, the payment architecture, paid campaigns built to clear review where your category allows them, and the organic and social engine that carries the load where it does not.
Categories We Work In
If a mainstream platform calls it high risk, it is normal work for us.
Four Ways This Category Kills Businesses
None of these are hypothetical. Every operator in this space has either lived through one of them or watched a competitor disappear because of one.
The Platform Can Switch You Off
Shopify, Wix, Squarespace, and BigCommerce all reserve the right to remove restricted-category merchants under their acceptable use policies. No warning, no appeal that goes anywhere, and often no clean export of the catalog you spent two years building. Self-hosting WooCommerce does not solve it, because the host, the payment extension, and every plugin in the stack each keep their own version of that same right.
One Payment Rail Is A Single Point Of Failure
Standard aggregators are not underwritten for your category. When a review lands and there is no second rail configured, revenue goes to zero that afternoon and stays there until somebody finds a new processor from scratch.
Your Ads Get Rejected For Reasons You Can Fix
Meta and Google restrict this category hard, and most rejections in it are earned: a claim in the creative, a landing page that argues with the policy, an account built like the last one that got pulled. Some categories are genuinely off limits and no amount of rewriting changes that. Plenty are not, and the operators in them lose the channel to sloppiness rather than to policy.
Most Agencies Will Not Touch It
They decline the work, or worse, they take the deposit and hand back a template that ignores half the rules that apply to you and leaves the compliance exposure sitting on your side of the table.
Go Search Your Own Category Right Now
Look at what comes back. A Telegram handle instead of a checkout. A price list in a DM. No lab documents, no company address, no refund policy, no way to reach a human who is not an anonymous account. Half of the results will not exist in a year and the buyers can tell.
That is your competition, and it is the single biggest opportunity in this category. Customers here are spending real money on something they put in their body or their lab. They are desperate to find one operator who looks like an actual company. Being that operator is a design and infrastructure problem, and it is entirely solvable.
What Buyers Find Today
What We Build Instead
The bar in this category is on the floor. Clearing it convincingly is the cheapest competitive advantage available to you.
What We Build For You
Not a template with a disclaimer bolted on. A complete commerce system designed around the specific ways this category fails, with the failure modes engineered out before launch.
Infrastructure You Actually Own
A custom application on infrastructure we provision and operate for you. No marketplace terms of service between you and your customers, no catalog review, no overnight deprovisioning, and no plugin vendor who can decide your category is a liability and take your checkout with them.
Redundant Payment Architecture
More than one rail, configured before you need it. Credit card processing through gateways that underwrite your category, taking Visa, Mastercard, American Express and Discover, with Apple Pay and Google Pay for mobile checkout, plus a self-hosted crypto channel running independently of the card networks. One rail pausing does not stop the store.
Compliance Enforced By The System
Age gating, jurisdiction rules, intended-use labeling, disclaimer enforcement, and per-product claim controls applied at the template level. A new SKU cannot ship missing them, because the system will not let it.
Lab Documentation And Batch Records
Certificate of analysis uploads, per-batch pages, and purity and identity documents linked to both the product and the order that shipped it. In this category, documentation is the conversion asset.
Organic That Never Needs Approval
Structured data, semantic markup, and content architecture built to rank in search and to get cited by ChatGPT, Claude, Gemini, and Perplexity. Whatever happens to an ad account, this is the channel no reviewer can revoke, and it is built to carry the whole load on its own if it has to.
Alerts With No Carrier Registration
A2P 10DLC hands your SMS campaign to carrier reviewers who reject this category as a matter of routine. We push order, payment and shipping events as real iMessage straight from your database, with replies captured back into the same system. No campaign filing, no vetting, no rejection letter.
Paid Ads Built To Clear Review
Where your category can be advertised, we run it: creative and landing pages written to the policy that actually governs them, the certifications the platform asks for, and account structure that does not read as a rebuilt ban. We will also tell you plainly when a category is prohibited outright rather than sell you a campaign that cannot survive review.
Social Accounts That Do Not Get Banned
Organic social stays open to this category as long as the account never hands the platform a reason to close it. We run them to the policies as they are actually enforced: education and brand instead of product claims, bios and captions written to survive review, and a link structure that does not trip an automated sweep. An account still standing in two years beats one that went viral and vanished.
Email On Rails You Control
Wired directly into delivery infrastructure rather than a marketing SaaS whose terms exclude your category. Your list is an asset you hold, not one you rent from a vendor that can cut you off at any point.
Subscriptions And Reorder Logic
Recurring billing, reorder cycle tracking, dunning, loyalty, and win-back automation. Repeat purchase is where the margin in this category actually lives, so we build for the second order, not just the first.
Affiliate And Referral Programs
Tracked referral links, click attribution, commission calculation, and payout management. When paid channels are closed, an affiliate network becomes your distribution.
Checkout That Survives A Bad Week
The businesses that die in this category are rarely the ones with a bad product. They are the ones that had a single payment rail and lost it on a Tuesday.
We have built and operate live checkout systems in restricted categories, so this is not a capability we are describing from a case study. Your store runs multiple independent payment paths from launch, including a self-hosted crypto channel that does not depend on the card networks at all. If one path pauses, orders keep landing while the account gets resolved.
Every processor relationship is opened in your real business name and category. Redundancy is what protects revenue here. Misrepresentation is what loses accounts permanently, and we will not build you a system that depends on it.
Single rail vs redundant rails
One aggregator account. Review lands, funds hold, checkout returns an error, and revenue is zero until somebody finds a replacement. Recovery takes weeks.
Multiple rails live from day one, including a channel outside the card networks entirely. A pause on one becomes a routing change, not an outage. Customers finish checking out either way.
What your checkout takes
Card Processing, Wallets, And A Rail Off The Card Networks
Full credit and debit card processing through a gateway that underwrites your category, so Visa, Mastercard, American Express and Discover all clear at checkout. Card details go straight from the buyer to the gateway through hosted fields and never land on the store server, which keeps the scope of what you have to protect small.
Apple Pay and Google Pay are wired in as well, because most of this traffic arrives on a phone and a wallet button converts far better than asking someone to type sixteen digits on a small screen. Alongside all of it runs a self-hosted crypto channel that settles without touching the card networks at all, which is the rail that keeps orders landing on the week a processor goes quiet.
Your Store Runs In Germany
That is a deliberate architectural choice, not a detail. It is also the single most oversold thing in this industry, so here is the accurate version of what it does and what it does not do. If someone has told you that hosting offshore makes you untouchable, they were either lying to you or they do not understand it themselves.
What It Genuinely Changes
Hardware we own, in a facility we rent
Your store runs on our own servers in colocation in Falkenstein, not a platform account somebody else can review and disable. No acceptable-use team reads your product names, no automated sweep flags your catalog, no ticket queue ends with your store switched off.
The US CLOUD Act does not reach it1
That law compels providers subject to US jurisdiction to hand over data they control, wherever the disk sits. In colocation nobody but us controls the data, and the facility around it is German with no US parent. AWS, Google Cloud, and Cloudflare are a different story entirely.
Everything moves at the speed of paperwork2
Reaching infrastructure in Germany means the Hague Service Convention and a German Central Authority. Germany objected to service through postal channels, so there is no shortcut. Where we register domains offshore behind privacy protection, that stacks another jurisdiction on top. Nothing here moves at the speed of a platform ticket.
Discovery is narrow, not impossible3
Germany refused pre-trial discovery of documents outright until 1 July 2022, when it narrowed that reservation. Requests now execute only where each document is described separately and in detail, is of immediate and clearly recognisable relevance, and is held by a party to the proceedings. Sweeping US-style document demands still do not survive that filter. Targeted ones can.
Search and seizure needs dual criminality4
Under the US and Germany mutual legal assistance treaty, a search and seizure request is executed only where the offense is punishable under the laws of both states, and it travels between designated central authorities rather than directly. That is a real filter and a slow one.
What It Does Not Do
It is not immunity
Valid German court orders get complied with, promptly. Jurisdiction changes who has to ask, in which forum, and how long asking takes. It does not mean nobody can.
Registries are the short path, not registrars5
Where a domain is bought matters less than who runs the extension. A .com answers to a registry in Virginia and a .us answers to one in Arizona, so an order can reach either without your registrar being involved at all. We choose extensions and registrars with that in mind, and on any store already running it is the first thing worth reviewing.
EU substantive law is stricter, not looser
German and EU rules on medicines and novel foods are serious. If your catalog would be illegal to place on the EU market, German infrastructure is a liability rather than a shield. Where you host and what you may lawfully sell are two different questions.
Payments are their own attack surface
A processor can close your account from anywhere, and no amount of infrastructure planning changes that. It is exactly why the payment architecture is built with redundancy from launch instead of being treated as a solved problem.
The honest summary: German hosting buys you procedural time and removes one specific American legal shortcut. It does not make you untouchable. What it actually gives you is an infrastructure layer that cannot be pulled by a US platform's policy team on a Tuesday afternoon, which is the thing that realistically kills stores in this category.
This is general information about how jurisdiction works, not legal advice. Your catalog and the markets you ship to are questions for your own counsel, and we will happily build to whatever they tell you.
Sources
- 1.CLOUD Act, codified at 18 U.S.C. § 2713 (Pub. L. 115-141, Div. V). Cornell Legal Information Institute.https://www.law.cornell.edu/uscode/text/18/2713
- 2.Hague Service Convention 1965, German declarations objecting to Article 10. HCCH status table.https://www.hcch.net/en/instruments/conventions/status-table/notifications/?csid=402&disp=resdn
- 3.Hague Evidence Convention 1970, German declaration under Article 23, amended 2022. HCCH status table.https://www.hcch.net/en/instruments/conventions/status-table/notifications/?csid=502&disp=resdn
- 4.US and Germany Treaty on Mutual Legal Assistance in Criminal Matters, Article 11. Senate Treaty Doc. 108-27.https://congress.gov/108/cdoc/tdoc27/CDOC-108tdoc27.pdf
- 5.Registry operators by extension. IANA Root Zone Database.https://www.iana.org/domains/root/db/
Paid Where It Clears, Organic Where It Does Not
Paid is not the closed door most operators in this category think it is. Some products are prohibited outright and we will say so on the first call rather than bill you to find out. For the rest, the rejections are usually earned: a claim the policy forbids sitting in the creative, a landing page that contradicts the ad, an account structured exactly like the last one that got pulled. We build campaigns to the policy that actually governs them, with the certifications the platform asks for and creative that does not hand a reviewer a reason.
Where paid is closed, organic is not a consolation prize, it is the stronger position. Your competitors are locked out of the same platforms, which means the search results in your category are winnable by whoever builds the better technical foundation, and nobody can simply outspend you to take them back.
That is the entire premise of how we build. Clean architecture, structured data, fast pages, and content designed to be cited by AI assistants as well as ranked by search engines. On Scale and Dominate plans it comes with our Niche Dominance Guarantee, and territory exclusivity means we will not turn around and build the same advantage for the competitor down the road.
Social runs on the same discipline and is judged by a separate system again: ad review and content policy are not the same desk, so a category that struggles to buy placement can still hold a real audience on the platform. We run those accounts compliant by default, with content written to what the guidelines actually enforce, claims kept off the posts, and bios and link structure built so a policy sweep finds nothing to act on. The point is an audience that is still there next year, because every follower on an account that survives is one your competitors keep losing to bans and starting over.
What That Looks Like In Practice
Measured figures from a research-compound storefront we build and operate, taken from two audit windows this spring. We are not naming the client, for the same reason we will not name you.
| Metric | Apr 11 to Apr 2414 days | May 11 to Jun 728 days | Per day |
|---|---|---|---|
| Search clicks | 40 | 663 | 2.9 to 23.7 |
| Search impressions | 770 | 2,223 | 55 to 79 |
| Sessions | 902 | 4,608 | 64 to 165 |
| Average position | 21.1 | 13.8 | higher is worse |
| Keywords ranking page 1 | 9 | 8 | held |
The two windows are different lengths, so the per-day column is the honest comparison. These totals include branded searches for the store name, which grow as any brand grows. The metric we would point to as ours is average position moving from 21.1 to 13.8, because that is the one that reflects the build rather than the brand. Most agencies would show you the big number and skip this paragraph.
What It Costs
Restricted-category builds carry work that a standard storefront does not, so they carry a one-time build fee. After launch you are on our normal published plans at the normal published price. No premium for the category, no renegotiation later.
Step one
Restricted-Category Build
Step two
Then Your Ongoing Plan
Standard published pricing. Cancel anytime, no contract.
Scale
The usual fit. Full commerce layer, subscriptions, unified inbox, workflow automation, and the Niche Dominance Guarantee for your city and radius.
Dominate
Adds territory exclusivity, which matters more in this category than in most. Locks your niche in your market so we cannot build the same advantage for a competitor.
Unusually large catalogs, multi-brand operations, or complex international shipping rules can move the build fee. If they do, we tell you before you pay anything, not after.
Your Build Stays Off Our Portfolio
Client work in these categories is unlisted by default. We do not publish case studies, we do not name you in marketing, and we do not put your logo on a wall unless you specifically ask us to. If you want a reference conversation with an existing client, we will arrange it privately.
Common Questions
The things operators in this category actually ask on the first call.
What counts as a restricted category?
Anything a mainstream platform or payment aggregator classifies as high risk. In practice that means supplements, nutraceuticals, research compounds and peptides, wellness and longevity products, vape and smoke accessories, adult products, firearms accessories, and subscription models with elevated chargeback profiles. If your last agency quoted the job and then stopped answering emails, you are in the right place.
Can I get shut down the way Shopify and WooCommerce stores do?
There is no platform sitting above you with the power to do it. Your store is a custom application running on infrastructure we provision and operate for you, so there is no marketplace acceptable-use review between you and your customers, no catalog audit, and no support ticket that ends with your products switched off overnight. Shopify, Wix, Squarespace and BigCommerce all reserve that right in writing and use it on this category as a matter of routine. Self-hosting WooCommerce is not the way around it either, which catches a lot of operators out, because open-source software does not make the stack around it safe: the store still sits on a host with its own acceptable-use policy, the checkout usually runs on a payment extension that can drop your category without notice, and the whole thing rests on a plugin stack where any single vendor deciding you are a liability takes a working checkout down with it. What we build carries none of those dependencies above the business.
Where are the servers, and does hosting outside the US actually protect me?
Falkenstein, Saxony, Germany, on hardware we own in colocation rather than a platform account somebody else controls. It helps in specific ways and it is wildly oversold by people who do not understand it. What it genuinely does: the US CLOUD Act, which compels providers subject to US jurisdiction to produce data regardless of where it is stored, does not reach this, because in colocation nobody but us controls the data and the facility around it is German with no US parent. Civil process has to travel through the Hague Service Convention and a German Central Authority, and Germany objected to service by post, so there is no shortcut. Germany refused pre-trial discovery of documents outright under the Hague Evidence Convention until 1 July 2022, when it narrowed that reservation, so requests now execute only where each document is described separately and in detail, is of immediate and clearly recognisable relevance, and is held by a party to the proceedings. Sweeping American-style document demands still do not survive that filter, though targeted ones can. On the criminal side, a search and seizure request under the mutual legal assistance treaty is executed only where the offense is punishable under the laws of both countries, and it travels between designated central authorities rather than directly. What it does not do: it is not immunity, because valid German court orders get complied with promptly. It does very little for your domain, because the registry that operates your extension is the short path and most extensions answer to a US registry no matter where you bought the name, which is a separate problem we plan for separately. And EU rules on medicines and novel foods are stricter than US rules, not looser, so if your catalog would be unlawful to place on the EU market then German hosting is a liability rather than a shield. General information, not legal advice.
What happens to revenue if a payment processor pauses my account?
We architect for that on day one instead of scrambling on the day it happens. Your checkout runs more than one rail: credit and debit card processing through gateways that underwrite your category, taking Visa, Mastercard, American Express and Discover, with Apple Pay and Google Pay wired in for the mobile traffic that makes up most of this category, and alongside it a self-hosted crypto channel that operates independently of the card networks. Card details pass from the buyer to the gateway through hosted fields and never touch the store server. If one rail goes quiet, the store keeps taking orders while the account gets sorted out. Every processor relationship is opened in your real business name and category, because a relationship built on anything else is the thing that actually loses you the account.
My ads keep getting rejected. Can you fix that?
Usually, yes, and the first thing we do is tell you which situation you are actually in. A handful of products are prohibited outright by Meta and Google, and for those the honest answer is that no rewrite gets you approved and we will say so before you spend anything. Most of this category is not in that bucket. It is restricted, which is a different thing, and the rejections come from causes you can fix: a claim the policy forbids sitting in the creative, a landing page that argues with the ad it is attached to, a missing certification, or an account structured so closely to the last one that got pulled that it reads as a rebuild. We write campaigns to the policy that actually governs them and build the landing pages to match, because in a restricted category the page is part of the ad review whether you treat it that way or not. Alongside paid we build the channels that never need approval at all: organic search, structured data, and content architecture optimized for AI assistant citations, compliant social accounts run to the content guidelines, plus email and SMS on infrastructure you control. That mix is deliberate. Paid can be paused by someone else and the rest of it cannot, so we do not let a store depend on the one channel it does not control. On our Scale and Dominate plans the organic side is backed by the Niche Dominance Guarantee.
My SMS campaign keeps getting rejected by the carriers. Any way around that?
Yes, by not asking the carriers. A2P 10DLC requires you to register a campaign and have it vetted before you can send application-to-person SMS, and reviewers reject this category routinely, which leaves a lot of operators with order confirmations they cannot deliver. We push order, payment and shipping events as real iMessage straight out of your database instead, and replies come back into the same system so conversations are logged rather than scattered across someone's phone. There is no campaign filing, no brand vetting, and no rejection letter to appeal, because no carrier registration is involved at any point. It sits alongside email rather than replacing it, and for customers who are not on iMessage we fall back to email, so the notification always lands somewhere.
How do you handle compliance language and product claims?
We build the constraints into the system rather than trusting anyone to remember them. Intended-use labeling, disclaimers, age gates, jurisdiction rules, and per-product claim controls are enforced at the template level, so a new SKU cannot go live missing them. We are not your regulatory counsel. We build the machine that enforces whatever you and your counsel decide.
My competitors all look like they are run out of a Telegram group. Does that matter?
It is the largest unclaimed advantage in your category. Search your own niche and most results are a chat handle instead of a checkout, no verifiable lab documents, no policies, no company identity, and no reason to believe the store will exist next quarter. Buyers here are spending real money and they read all of that as risk. Looking like a legitimate, permanent business is a design and infrastructure problem, which means it is one you can simply pay to solve while your competition does not.
Can you migrate my existing store?
Yes. Products, customers, order history, subscriptions, lab documents, and content all move over, with redirects mapped so you do not lose search rankings in the process. Most migrations run in parallel with the live store until the new one is verified.
Will my brand show up in your portfolio?
No. Client work in these categories stays unlisted unless you specifically ask to be featured. Discretion is part of the service.
What does this cost?
A one-time restricted-category build fee of $9,997, then your ongoing plan at standard published pricing: Scale at $2,997 per month, or Dominate at $5,497 per month if you want territory exclusivity. The build fee covers the work a normal storefront does not need, which is the compliance layer, the multi-rail payment architecture, the certificate of analysis and batch record system, and migration off whatever you are on now. We do not charge a premium on the monthly rate for the category. Unusually large catalogs or complex international shipping can move the build fee, and if that applies to you we say so before you pay anything.
Tell Us What You Sell
No judgement, no lecture, and no quote that quietly triples once we find out what the products are. Describe the catalog and the situation, and we will tell you straight whether we can build it, what it takes, and what it costs.