Battle-tested in our own UK e-commerce stack. One yarn add, one config line, ready in 5 minutes.
Per-link transactional email tracking with human-vs-machine classification, sensitive-link redaction and a per-order activity timeline.
37 region presets, soft-block mode, IP allowlist, audit log, "what-if" simulator.
Self-hosted visitor journey, cart abandonment, product recommendations, search analytics — one plugin, one database, no third party.
Signal-based risk scoring on every order, monitor/enforce modes, review queue with customisable customer comms, alerts to Slack/Discord/Teams/Telegram, daily threat feeds — chargebacks stopped before fulfilment.
Automated post-purchase Trustpilot review invitations, timed off order dates — free Trustpilot integration, customer exclusions, cooldown, editable emails.
At a glance
| Email Tracking | Geo Block | Visitor Analytics | Fraud Prevention | Review Requests | |
|---|---|---|---|---|---|
| Drop-in install (one yarn add) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Channel-aware | ✓ | ✓ | ✓ | ✓ | ✓ |
| Admin UI included | ✓ | ✓ | ✓ | ✓ | ✓ |
| Database tables | 2 | 1 | 2 | 8 | 5 |
| Public HTTP endpoints | 4 | 3 | 1 | 1 | 1 |
| Admin HTTP endpoints | 7 | 5 | 15 | 20 | 13 |
| Privacy controls | IP hash | IP allowlist | DNT, IP anonymisation, consent gate | Allowlist bypass | Opt-out + exclusions |
| Offline licence verification | ✓ | ✓ | ✓ | ✓ | ✓ |
| Self-hosted (no calls to us at runtime) | ✓ | ✓ | ✓ | ✓† | ✓† |
† Two plugins make optional outbound calls to third parties, never to Hulo Global. Fraud Prevention fetches threat-intelligence — IP-reputation lookups (ip-api.com) and nightly public blocklist feeds (FireHOL, Spamhaus, Tor, disposable-email domains), cached, and switchable off. Review Requests optionally reads your live rating from the free Trustpilot API and sends invitation emails via your own SMTP. As with every plugin, nothing phones home to us at runtime for the core function.
Compatibility
Every plugin is built and smoke-tested against the newest Vendure release before publishing. The table below is the current support surface — installs cleanly with yarn or npm.
| Plugin | Latest | Vendure core | Node | TypeScript | Verified on |
|---|---|---|---|---|---|
| Email Tracking | v0.8.4 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Geo Block | v0.7.4 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Visitor Analytics | v0.11.1 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Fraud Prevention | v0.8.0 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Review Requests | v0.8.0 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
A boot-time check emits a non-fatal warning if @vendure/core is outside the tested range, so a future 3.x upgrade is always safe to try. Vendure 4.0 will be tested and re-declared once its changelog lands. Node 20 LTS or newer recommended.
FAQ
Each plugin is licensed individually. Monthly subscription with a 7-day free trial (then £9.95/mo, cancel any time), or one-off lifetime (£199, never expires, 12 months of updates included). Both options give you a JWT licence key you set as an env var.
Pick the monthly plan and enter your email. We collect a payment method via Stripe but don't charge for 7 days — and we'll send a reminder email 2 days before the trial ends so you can cancel if you change your mind. Trials are limited to one per customer; we detect repeat attempts by the card fingerprint, not just the email.
Every receipt email includes a Stripe Customer Portal link — click it to update your payment method, see invoices, or cancel. No need to email us. Lifetime customers have nothing to manage; reply to your receipt if you need a VAT invoice.
Re-send every active key on file at elite.charity/licence/forgot. We always show the same confirmation regardless of whether the email is on file (anti-enumeration), so check spam if nothing arrives. Limited to 5 requests per email per day.
Yes — under UK GDPR you have a right to see, export and erase the personal data we hold. Visit elite.charity/licence/privacy and we'll email you a magic link to do both.
No — licence verification is offline. Each plugin verifies the JWT at boot against an embedded public key. A revocation list is polled once a week (cached, soft-fail), so a brief outage at our end never disables your store. Nothing else leaves your server.
On your Vendure server — same DB as the rest of your data. No third-party analytics provider. The visitor-analytics plugin's ingest endpoint is on your domain.
Plugins still boot in a degraded "evaluation" mode — install, configure, browse data, and the admin UI is functional. The public storefront endpoints are limited (geo-block always reports `enabled:false`; visitor-analytics dashboards return 403). Buy a key when you're ready.
Yes — all five are on GitHub under github.com/exceeded. MIT-style licence on the code itself, separate paid licence for production use.
They target Vendure 3.x (3.0+). Vendure 2.x isn't supported because we use some of the 3.x customField improvements.