How it works
Three steps, and nobody makes an account
The whole loop lives on the WooCommerce order your staff are already looking at.
-
Step 1
Staff attaches the proof to the order
The proof panel lives on the WooCommerce order itself, so nobody has to learn a second system or remember which shared folder the artwork went into.
Upload a new version whenever the design changes. Every version is kept, numbered, and comparable side by side against the one before it.
The panel shows the running event count and a one-click control to resend or reissue the customer link.
-
Step 2
The customer opens one link and decides
No account, no login, no portal invitation. The customer receives a tokenized link, sees the proof, and picks one of two clearly worded options.
"I approve this proof" sends the job forward. "I need changes" captures a comment so the designer knows exactly what to alter.
The page is keyboard-operable and works on the phone the customer is actually holding.
-
Step 3
The decision is written to the record, and production unlocks
Their outcome, the exact wording they selected, the UTC timestamp and the file's SHA-256 fingerprint are appended to a hash-chained event trail on the order.
Each entry carries the hash of the one before it, so a later edit to any earlier entry breaks the chain visibly. That is what makes the record tamper-evident.
While a proof is outstanding the order is held out of your production statuses. When the customer approves, the hold lifts.
The three things that decide whether this works
Production lock, in the free plugin
The mechanism that prevents the remake ships free, because a plugin that only records the argument after the fact has not solved anything.
One global toggle holds orders out of Processing and Completed while a proof is outstanding, and the order screen states plainly why the status will not move.
The paid tiers add per-product, per-category and per-status rules, plus an override that is itself written to the record.
A record built to survive the argument
Every event is timestamped in UTC, fingerprinted with SHA-256, and chained to the event before it.
The record states what the customer saw, which wording they chose, and when — and it says in plain English what the document is and is not.
It is a tamper-evident business record, not a signature product. We are specific about that in the document itself.
Your customer never makes an account
Approval happens at a tokenized URL with a lifetime you control. There is no registration wall, no password reset, and no portal for anyone to get lost in.
That single decision is why approvals come back in hours instead of days, and it is available in the free plugin.
Links can be resent or reissued from the order at any point.
Everything else it does
-
Proof panel on the order
Attach, resend and reissue without leaving the WooCommerce order screen.
-
Unlimited versions
Every round is kept and numbered. No cap, at any tier.
-
Side-by-side compare
Put two rounds next to each other and see what actually changed.
-
Tokenized guest links
Approval without an account, with a link lifetime you set.
-
Comment on a change request
The customer says what is wrong in their own words, on the record.
-
Hash-chained event trail
Each entry carries the hash of the previous one, so later edits show.
-
SHA-256 file fingerprints
The record identifies the exact file the customer looked at.
-
UTC timestamps
One timezone in the record, displayed in yours.
-
Production lock
Hold guarded statuses while a proof is outstanding. Free tier.
-
Customer and staff email
Sent on issue, decision and reissue, with a copyable link.
-
HPOS-native
Built against High-Performance Order Storage, not retrofitted to it.
-
Private file storage
Masters live outside the web root behind an access check.
-
Retention controls
Decide how long master files are kept after a decision.
-
Hooks and REST routes
A documented public surface for the things you will want to automate.
-
Translation-ready
Every customer-facing string is translatable, including the approval page.
The evidence
What the record contains
The outcome, the exact wording the customer chose, a UTC timestamp, the file's SHA-256 fingerprint, and every event chained to the one before it.
An example of the record ApprovalTrail keeps
- 2026-03-04 09:12:07 UTC Proof v1 attached to order Entry fingerprint: 3f9c1a7e…8d20
- 2026-03-04 09:12:44 UTC Approval link sent to customer Entry fingerprint: a41b6002…17ce
- 2026-03-05 14:38:19 UTC Customer requested changes Changes requested Entry fingerprint: c7e5d913…4b8a
- 2026-03-06 08:02:55 UTC Proof v2 attached, link reissued Waiting Entry fingerprint: 92ba0f47…e611
- 2026-03-06 11:47:31 UTC Customer approved proof v2 Approved Entry fingerprint: d0417c8b…5f39
Every entry stores the hash of the entry before it, so a later edit to any earlier line stops the chain matching. This is a timestamped, tamper-evident business record of what the customer was shown and what they chose — not a signature service.
The boundary, stated plainly: this is a timestamped, tamper-evident business record of what your customer was shown and what they chose. It is not a signature service and we make no claim about legal enforceability. What it gives you is the record that settles the argument before it becomes one.
Pricing
What it costs
Free covers a single shop completely, forever. Pro is $49 a year for one site, Studio $79 for five, Agency $149 for twenty-five.
Annual licenses only, no lifetime tier, and no charge you cannot undo.
30-day money-back guarantee. No form, no reason required.
Tested against
- WordPress
- 6.9 and up
- WooCommerce
- 8.0 and up
- PHP
- 8.2 and up
- Order storage
- HPOS and legacy
- Multisite
- Supported
ApprovalTrail is a new plugin from Real Point Media — too new to show you an install count or a review score. What we can show you is the code it is tested against, the record it produces, and a money-back guarantee that carries the risk instead of you.
What you get either way
-
Documentation
Every screen, setting, hook and REST route is written up before you need it.
-
30-day money-back guarantee
Ask within thirty days of the charge and we refund it. No form and no reason required.
The questions shops ask
Does my customer need a WordPress account?
No. They open a tokenized link, look at the proof, and choose approve or request changes. There is no registration step at any point, and this is in the free plugin.
What does "hash-chained" actually mean here?
Every event in the record stores a SHA-256 hash that includes the hash of the event before it. Change an earlier entry and every later hash stops matching, which is visible on the record. That makes the trail tamper-evident.
Is the approval record legally enforceable?
We do not claim that, and you should be suspicious of any plugin that does. What ApprovalTrail produces is a timestamped, tamper-evident business record of what your customer was shown and what they chose. The record itself says so in plain English.
Does it work with High-Performance Order Storage?
Yes. HPOS is the primary integration path rather than an afterthought, and the plugin declares compatibility so WooCommerce will not warn you.
What happens to a job while the customer has not answered?
The order is held out of the statuses you have chosen to guard, and the order screen explains why. When the customer approves, the hold lifts by itself.
Is there a limit on proofs or orders in the free plugin?
No. Proofs, orders and versions are unlimited at every tier including free. The paid tiers add capability, not headroom.