Ewithme Trust & Verified Reviews

Description

eWith.me Trust is an open verification protocol and customer review plugin for WordPress and WooCommerce.

Unlike hosted review platforms where feedback is locked in a third-party silo, eWith.me stores all review data in your own WordPress database (wp_ew_reviews). When you opt in to connect the eWith.me verification service, each verified review receives a detached Ed25519 cryptographic attestation and text commitment registered on an append-only ledger, allowing anyone to verify review authenticity offline using the bundled verifier (Ewithme_Trust_Verifier) without contacting eWith.me servers.

Why eWith.me Trust?

• Full Data Ownership: Store reviews in your local WordPress database. No vendor lock-in and full local functionality.
• Explicit Opt-In Privacy: Never phones home on activation. External API connection is 100% opt-in from your Settings screen.
• Cryptographic Attestations (Protocol v2): Reviews are canonicalized with RFC 8785 (JCS) and signed using detached Ed25519 signatures. Anyone can verify proofs offline using the bundled Ewithme_Trust_Verifier class.
• Search Central Compliance: Automatically generates valid JSON-LD Product and AggregateRating schema exclusively on single product pages. Suppressed on home, about, category, and archive pages to protect against Google rich snippet manual actions.
• Transparent Verification Tiers: Distinguishes between purchase_verified (automatically hooked to WooCommerce completed orders), email_confirmed, and native_imported reviews.
• FTC & EU Omnibus Disclosure: Includes the [ewithme_disclosure] shortcode explaining how reviews are collected and verified, and automatically excludes incentivized reviews from structured data.
• Cryptographic Erasure (GDPR): Supports both administrator moderation and author self-service erasure via capability tokens (ew_erase_... issued upon review submission). Reviewers can erase their review plaintext and personal data directly via the storefront “Self-Service Erasure (GDPR)” modal or the /wp-json/ewithme/v1/erase-review REST endpoint while maintaining hash chain continuity.
• Anti-Suppression Audit Layer: Detects hidden or deleted reviews by comparing registered reviews against displayed storefront reviews.
• Domain Proof of Control: Gated by DNS TXT record or HTTP challenge endpoint (/wp-json/ewithme/v1/verify-origin) to prevent third-party domain spoofing.

External services

This plugin can optionally connect to the eWith.me Trust Verification API (https://ewith.me) to send single-use email confirmation links to reviewers, issue detached Ed25519 cryptographic signatures over review commitments, and synchronize your public anti-suppression audit ledger.

Important Privacy Guarantee: This plugin does not transmit any data during plugin activation. Connecting to eWith.me requires explicit administrator opt-in under Trust Reviews > Settings.

When connected, data is transmitted to https://ewith.me under the following specific conditions:

1. API Key Provisioning (POST https://ewith.me/api/v1/trust/provision):
   • When: Only when the site administrator checks the consent box and clicks “Opt-In & Provision Free API Key” in Trust Reviews > Settings.
   • Data sent: Store domain name, site title, and (only if optionally checked by the administrator) the administrator email address.
2. Domain Ownership Verification (POST https://ewith.me/api/v1/trust/verify-domain):
   • When: Only when the site administrator clicks “Verify Domain Control Now” in Trust Reviews > Settings.
   • Data sent: Store domain name and selected verification method (auto, dns, or http).
3. Customer Review Verification Request (POST https://ewith.me/api/v1/trust/request-verification):
   • When: When a customer submits the review form on the frontend (or when a native WooCommerce review is submitted if the administrator opted in to native comment notarization).
   • Data sent: Reviewer display name, reviewer email address (used strictly to dispatch the 1-click verification link and deleted after confirmation), star rating, review title, review text, product ID/title, verification tier, incentivized status, and the author’s erasure capability token.
4. Cryptographic Review Erasure (POST https://ewith.me/api/v1/trust/erase-review):
   • When: Only when the administrator has explicitly opted in (external_service_optin) and configured an API key, AND a verified local review with a remote certificate ID is erased by its author via their Erasure Capability Token or moderated by an administrator in Trust Reviews > All Reviews. When operating in Local Mode (without opt-in), erasure is performed strictly within the local WordPress database with zero external network requests.
   • Data sent: Review Certificate ID (cert_id), Erasure Capability Token (erasure_token), and moderation/erasure reason (reason).
5. Quota Status & Ledger Synchronization (GET https://ewith.me/api/v1/trust/quota-status and GET https://ewith.me/api/v1/trust/feed/{domain}):
   • When: Only when the administrator has explicitly opted in and configured an API key, and views the Settings screen (cached for 1 hour) or clicks “Sync with eWith.me Ledger”.
   • Data sent: Store domain name and Bearer API key.

This service is provided by eWith.me:
* eWith.me Trust Service Overview
* eWith.me Terms of Service
* eWith.me Privacy Policy

Available Shortcodes

• [ewithme_reviews]: Renders the single-product review grid, average score summary, cryptographic verification marks, interactive customer review submission modal, and self-service GDPR erasure modal.
• [ewithme_reviews scope="all"]: Displays a store-wide testimonials wall aggregating all verified store reviews on a dedicated page (e.g. yourstore.com/reviews). Automatically suppresses the submission modal to isolate single-product rich snippet schemas.
• [ewithme_badge]: Displays a compact verified rating pill linking to your domain’s live public audit report (ideal for site headers, footers, or checkout trust badges).
• [ewithme_audit_badge]: Displays the live count of displayed verified reviews and links directly to your domain’s public audit ledger.
• [ewithme_disclosure]: Generates a dynamic consumer review transparency policy statement explaining collection and verification criteria (satisfies FTC and EU Omnibus Directive requirements).