Battle-tested in our own UK e-commerce stack. One yarn add, one config line, ready in 5 minutes.
End-to-end quotation engine — build quotes from your catalogue, email a signed accept/decline link, chase automatically, convert wins to draft orders at the exact quoted total.
Per-link transactional email tracking with human-vs-machine classification, sensitive-link redaction and a per-order activity timeline.
37 region presets, soft-block mode, IP allowlist, audit log, "what-if" simulator.
Self-hosted visitor journey, cart abandonment, product recommendations, search analytics — one plugin, one database, no third party.
Signal-based risk scoring on every order, monitor/enforce modes, review queue with customisable customer comms, alerts to Slack/Discord/Teams/Telegram, daily threat feeds — chargebacks stopped before fulfilment.
The credit-customer platform for Vendure B2B: applications, invitations and auto-approval, per-customer limits with an audit trail, multi-user company accounts, Pay on Account with net-terms invoices, prepaid funds, settlements by any method with Stripe pay links, payment plans, statements, dunning and a reward-points programme — in one admin dashboard and one storefront API.
One payments plugin for Vendure: eleven payment systems — Stripe, Adyen, PayPal, Mollie, Square, Braintree, GoCardless, Checkout.com, crypto, bank transfer and pay-later — behind a single contract, with a hosted checkout page, wallets, 3-D Secure, captures, refunds, disputes, saved cards, subscriptions, pay-by-link, routing and one ledger.
The safety layer around Vendure checkout and payments: Stripe manual-capture holds that actually place the order, bank transfer with auto-expiry, failed-payment and orphaned-charge visibility with nightly Stripe reconciliation, session-bound order lookup, checkout rate limits and a funnel — in one admin dashboard.
Automated post-purchase Trustpilot review invitations, timed off order dates — free Trustpilot integration, customer exclusions, cooldown, editable emails.
At a glance
| Quotations | Email Tracking | Geo Block | Visitor Analytics | Fraud Prevention | Review Requests | Checkout Guard | Business Credit | |
|---|---|---|---|---|---|---|---|---|
| Drop-in install (one yarn add) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Channel-aware | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Admin UI included | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| MySQL / MariaDB / PostgreSQL | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Licence activation in the admin | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| One-click in-app updates | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Database tables | 4 | 2 | 1 | 2 | 8 | 5 | 3 | 14 |
| Privacy controls | Signed links, no tracking pixels | IP hash | IP allowlist | DNT, IP anonymisation, consent gate | Allowlist bypass | Opt-out + exclusions | Session-bound order access | Customer-scoped API, no card data stored |
| Offline licence verification | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Self-hosted (no calls to us at runtime) | ✓ | ✓ | ✓ | ✓ | ✓† | ✓† | ✓ | ✓ |
† Two plugins make optional outbound calls to third parties, never to Hulo Global. Fraud Prevention fetches threat-intelligence — IP-reputation lookups (ip-api.com) and nightly public blocklist feeds (FireHOL, Spamhaus, Tor, disposable-email domains), cached, and switchable off. Review Requests optionally reads your live rating from the free Trustpilot API and sends invitation emails via your own SMTP. As with every plugin, nothing phones home to us at runtime for the core function.
Compatibility
Every plugin is built and smoke-tested against the newest Vendure release before publishing. The table below is the current support surface — installs cleanly with yarn or npm.
| Plugin | Latest | Vendure core | Node | TypeScript | Verified on |
|---|---|---|---|---|---|
| Quotations | v0.7.3 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Email Tracking | v0.14.3 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Geo Block | v0.13.3 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Visitor Analytics | v0.18.5 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Fraud Prevention | v0.19.2 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Business Credit | v0.3.3 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Payments | v0.2.10 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Checkout Guard | v0.1.4 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
| Review Requests | v0.15.3 | 3.5 – 3.7 | 20 LTS+ | 5.4 – 6.x | ✓ 3.7.1 |
A boot-time check emits a non-fatal warning if @vendure/core is outside the tested range, so a future 3.x upgrade is always safe to try. Vendure 4.0 will be tested and re-declared once its changelog lands. Node 20 LTS or newer recommended.
FAQ
Each plugin is licensed individually. Start a 14-day free trial from the plugin's admin page — card required, nothing charged until day 15, cancel any time — which continues as a monthly (£2.95–£14.95/mo) or annual (two months free) subscription. Or buy a one-off lifetime licence (£59–£299, never expires, 12 months of updates included). Every option gives you a JWT licence key that installs itself in the admin.
Open the plugin's page in your Vendure admin, pick monthly or annual on the licence banner and click Start 14-day free trial (or choose lifetime and click Buy lifetime). Stripe Checkout opens in a new tab; within a minute of payment the licence installs itself in the admin — no email round-trip, no .env edit, no restart. Renewed subscription keys are picked up automatically. Prefer to buy on the web? Use the plugin's buy page and paste the emailed key into the admin instead.
Every receipt email includes a Stripe Customer Portal link — click it to update your payment method, see invoices, or cancel. No need to email us. Lifetime customers have nothing to manage; reply to your receipt if you need a VAT invoice.
Re-send every active key on file at elite.charity/licence/forgot. We always show the same confirmation regardless of whether the email is on file (anti-enumeration), so check spam if nothing arrives. Limited to 5 requests per email per day.
Yes — under UK GDPR you have a right to see, export and erase the personal data we hold. Visit elite.charity/licence/privacy and we'll email you a magic link to do both.
No — licence verification is offline. Each plugin verifies the JWT at boot against an embedded public key. A revocation list is polled once a week (cached, soft-fail), so a brief outage at our end never disables your store. Nothing else leaves your server.
On your Vendure server — same DB as the rest of your data. No third-party analytics provider. The visitor-analytics plugin's ingest endpoint is on your domain.
Plugins still boot in a free tier — install, configure, browse data, and the admin UI is functional. The public storefront endpoints are limited (geo-block always reports `enabled:false`; visitor-analytics dashboards return 403). Buy a key when you're ready.
Yes — every plugin is on GitHub under github.com/huloglobal and github.com/exceeded. MIT-style licence on the code itself, separate paid licence for production use.
They target Vendure 3.x (3.0+). Vendure 2.x isn't supported because we use some of the 3.x customField improvements.