=== CatCode Antifraud with Konduto for WooCommerce ===
Contributors: catcodestudio
Tags: antifraud, fraud, konduto, brazil, woocommerce
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Fraud analysis of WooCommerce orders with Konduto: score, recommendation and triggered rules for each order, right in the order screen.

== Description ==

Sends a WooCommerce order to your own [Konduto](https://www.konduto.com/) account for fraud analysis and shows the answer in the order: the recommendation (approve, review or decline), the score from 0 to 1 and the rules that fired.

* **One button in the order** — "Send to Konduto for analysis" in the Konduto box of the order screen. The recommendation, the score and the rules appear in the box and in the order notes.
* **Full order data** — buyer (name, e-mail, phone, CPF/CNPJ), billing and shipping address, the items of the cart, totals, IP address and the payment type, as the Konduto Orders API asks for them.
* **Brazilian checkout fields understood** — CPF, CNPJ, number, neighbourhood, cellphone and birth date are read from the usual meta keys of Brazilian checkout-field plugins (`_billing_cpf`, `_billing_cnpj`, `_billing_number`, `_billing_neighborhood`…).
* **Payment methods mapped** — each payment method of the shop is reported as Pix, boleto, credit or debit card, transfer, voucher or balance: guessed automatically or chosen by you.
* **Refresh** — read the current Konduto status of an order again (for example after an analyst approved it in Konduto).
* **Sandbox ready** — test keys (starting with T) work the same way; Konduto simulates the answer from the cents of the order total.
* **Order number prefix** — a test copy of the shop or a second shop on the same Konduto account never sends the same number twice.
* Clear messages instead of raw API errors: a refused key, a missing field ("/customer/tax_id"), a Konduto outage.
* HPOS and block checkout compatible. The private key is stored encrypted.
* Translations included: English, Brazilian Portuguese.

= Pro =

The Pro version is sold on [catcode.com.ua](https://catcode.com.ua/modules/catcode-antifraud-with-konduto-for-woocommerce/), with a 7-day trial that never starts by itself:

* **Automatic analysis** — every order goes to Konduto by itself, as soon as it is placed or when it is paid, in the background, with up to three retries when Konduto cannot be reached.
* **Action on the recommendation** — "Review" puts the order on hold; "Decline" puts it on hold or cancels it. An unpaid Pix or boleto order is not touched until the payment arrives, then it waits on hold instead of going to Processing.
* **Konduto notifications (webhook)** — when an analyst approves or declines the order in Konduto, the order follows by itself: back to the status it had, or cancelled. Every notification is checked with the HMAC signature.
* **Your decision back to Konduto** — approve, decline or mark as fraud (chargeback) from the order screen, with a comment; cancelled orders and failed payments are reported to Konduto, so the model learns from them.
* **Failed payments for learning** — orders whose payment failed can be sent without analysis (Konduto bills only analysed orders).
* **Visitor tracking** — the Konduto script on the storefront, page tags, and the visitor ID of each order, the behaviour data Konduto weighs most.
* **Blocklist, allowlist and reviewlist** — add the e-mail, CPF/CNPJ, phone or IP of an order with one click, or any value from the report page.
* **Orders list** — a Konduto column with the recommendation and score, and the bulk action "Send to Konduto for analysis".
* **Report** — the last 30 days by recommendation, the orders waiting for review or declined, and the journal of every call to Konduto.
* Updates from catcode.com.ua.

The licence runs for 1-5 years and includes updates and support for that term; a purchased licence keeps its Pro features after the term ends. One key covers two sites: the shop and its test copy.

Konduto is a trademark of its owner. This plugin is an independent integration made by CatCode; it is not an official plugin of Konduto and is not affiliated with or endorsed by it. You need your own Konduto account and keys.

== External services ==

The plugin connects to the Konduto Orders API (Konduto by Equifax Brazil, [konduto.com](https://www.konduto.com/), API documentation at [konduto.readme.io](https://konduto.readme.io/)) at `api.konduto.com`, and only after you save your private key.

* When an order is sent for analysis: the order number, totals, currency, the buyer's IP address, name, e-mail, phone, CPF/CNPJ and birth date (when the shop has them), billing and shipping addresses, the items of the cart (name, SKU, price, quantity, image link) and the payment type, authenticated with your private key.
* When you press "Refresh the analysis" or "Check connection": the order number (or a made-up one for the check) and your private key.
* With Pro, the same order data is sent by itself when an order is placed or paid; your decisions (approved, declined, fraud, cancelled, payment not authorised) with your comment; and the values you add to the Konduto blocklist, allowlist or reviewlist.
* With Pro and the storefront script switched on, the Konduto script `https://i.k-analytix.com/k.js` is loaded on the pages of the shop with your public key (and the customer ID of logged-in buyers, if you allow it); it collects browsing and device data for fraud analysis. Mention it in your privacy policy.
* With Pro, Konduto sends status notifications to the address of your site shown on the settings screen.

Konduto belongs to Equifax Brazil, so konduto.com opens equifax.com.br. [Terms of use and privacy notice](https://www.equifax.com.br/legal/termo-de-uso-e-aviso-de-privacidade/)

== Installation ==

1. Upload the plugin and activate it. WooCommerce must be active.
2. WooCommerce → **Konduto**. Paste the private and the public key from the Konduto dashboard and press "Check connection".
3. Check how your payment methods are reported (Pix, boleto, card…) and save.
4. Open an order and press "Send to Konduto for analysis" in the Konduto box.

== Frequently Asked Questions ==

= Do I need a Konduto account? =

Yes. The analysis is done and billed by Konduto through your account; the plugin does not sell analyses.

= How do I test without real orders? =

Use the sandbox keys of your account (they start with T). Konduto then answers from the cents of the order total: ,00–,29 approve, ,30–,59 review, ,60–,99 decline.

= Konduto refused an order. Where do I see why? =

In the Konduto box of the order and in the order notes, for example "Konduto refused the data: /customer/tax_id". Most often the CPF is missing: Konduto requires the document of the buyer.

= Are card numbers sent? =

No. WooCommerce does not keep card numbers. A payment plugin that knows the BIN and the last four digits can pass them with the filter `catcode_konduto_card`.

== Changelog ==

= 1.0.0 =
* First release.
