How EntryProof scans your store

EntryProof v0 answers a narrow question: does a store's publicly listed product catalog show the obvious signals of a shipment that will be flagged at the port for missing CPSC electronic-filing data under the mandatory rule that went live Jul 8, 2026? This page explains exactly how that scan works, what data sources it references, and — most importantly — what a v0 heuristic scanner is honestly not capable of.

1. The regulatory background

The CPSC Product Registry electronic-filing rule at 16 CFR Part 1110 went mandatory Jul 8, 2026. It requires specific data elements (importer of record, manufacturer name and address, product identifier, applicable safety rule citations, and the testing lab that issued the CPC) to be transmitted electronically through CBP's ACE system using the PGA message set. A filing that's missing a required PGA data element can hold a container at the port even if the CBP-side entry looks clean.

2. What the scanner actually does (Quebec8 real-fetch, Aug 24 2026)

EntryProof today does not connect to your customs broker's ACE filing system, does not read your actual submitted PGA message sets, and does not certify a filing as compliant. What it does do is take a store URL plus an HTS code, and run four real checks:

1. URL canonicalization. Before anything else, we canonicalize the URL you enter: force https://, lowercase the hostname, strip a leading www., drop tracking params (utm_*, fbclid, gclid, …), and normalize the path. allbirds.com, www.allbirds.com, and https://ALLBIRDS.com/?utm_source=email all resolve to the same canonical form — and therefore the same cache row and the same score. Pre-Quebec8 the same store could score differently depending on which shape you pasted; that's fixed.
2. Real HTML fetch (server-side, SSRF-hardened). The canonical URL is fetched by an 8-second, 2MB-capped safeFetch that blocks private/link-local, loopback, cloud-metadata (169.254.169.254), and CGNAT addresses. If the fetch fails — bad URL, timeout, redirect to a blocked address, non-HTML response — the scan returns a real error message instead of a fabricated score. Successful fetches are cached per canonical URL for 24 hours (cpsc_efile.scan_signal_cache), so repeat scans of the same store don't re-fetch and are guaranteed deterministic.
3. 5-signal HTML detection. Against the fetched response body we run five deterministic detectors and record a short evidence quote for each hit:
   • Age-grading: "Ages 3+", "For children under 12", ASTM F963 references, schema.org targetAge.
   • CPSC-accepted testing lab: SGS, Bureau Veritas, Intertek, TÜV Rheinland, TÜV SÜD, UL / Underwriters Laboratories, Eurofins, ETL, CSA, plus generic "third-party testing lab" and "CPSC-accepted lab" phrases.
   • Manufacturer / country of origin / address: "Made in …", "Manufactured by …", schema.org Organization address blocks, "Imported by ", "Distributed by ".
   • Product certificate or CFR / ASTM citation: CPC, GCC, 16 CFR § references, ASTM F standards, CPSIA references, tracking labels, batch/lot numbers.
   • California Proposition 65 warning: "Proposition 65", "WARNING … California", P65Warnings.ca.gov. Not a CPSC signal, but a strong compliance-awareness indicator.
   We deliberately only ship 5 signals — the ones we can detect reliably from a real product page. That's the honest coverage.
4. HTS-chapter to CPSIA-rule matching (v0.7). Your HTS code is validated (4, 6, 8, or 10 digits), then run against 20 real CPSIA rules (see Section 4 below) with real CFR citations. Each applicable rule contributes to the score and to the per-rule detail grid shown alongside the result.

The final score = base 40 + up to 25 for HTML signals detected + up to 30 for applicable v0.7 CPSIA rules + 8 for a well-formed HTS (or -5 for a malformed one) - 5 per critical missing signal (for children's-product HTS profiles). Clamped 0-100. Same canonical URL + same HTS + same detected signals ⇒ same score, always.

None of this constitutes a compliance certification. A green EntryProof scan means "the public signals we can detect look consistent with a compliant listing" — it does not mean "your PGA message set will pass ACE validation." The scanner itself carries this disclosure in the same UI as every result, not buried in Terms of Service.

3. Data sources for the ruleset

• 16 CFR Part 1110 — the CPSC electronic-filing rule itself, source of the required data-element list.
• CPSC Business Guidance library — chapter-by-chapter applicability guidance for CPSA-regulated product categories.
• USITC Harmonized Tariff Schedule — the authoritative HTS chapter/heading/subheading table used for HTS-code validation and chapter-to-CPSC mapping.
• CBP ACE PGA message-set documentation — reference for which fields the CPSC PGA message set actually carries at entry (the "what a compliant filing looks like" anchor for the heuristics).
• CPSC Recall database — historical pattern data on what kinds of missing-documentation cases have actually triggered recalls, used to weight heuristic severity.

4. Rules the scanner applies

v0.7 real-rule engine (20 rules, Aug 21, 2026): each rule cites a real CFR citation verified against the eCFR primary source. When any of these fire for the HTS you provide, the badge reads v0.5-partial (1-4 rules match) or v0.7-substantial (5+ rules match).

• R1   Total-lead limits — 16 CFR § 1303
• R2   Small parts (under-3 choking) — 16 CFR § 1501
• R3   Drawstrings in children's upper outerwear — 16 CFR § 1120
• R4   Magnet ingestion hazards — 16 CFR § 1262
• R5   Phthalate limits (CPSIA § 108) — 16 CFR § 1307
• R6   Cadmium in children's jewelry (ASTM F2923) — via 16 CFR § 1250
• R7   Children's sleepwear flammability — 16 CFR §§ 1615 / 1616
• R8   Bicycle helmets — 16 CFR § 1203
• R9   Toy safety (ASTM F963-23) — 16 CFR § 1250
• R10 Full-size baby cribs — 16 CFR § 1219
• R11 Art & craft materials labeling (LHAMA) — 16 CFR § 1500.14(b)(8)
• R12 Toy chest lid supports (ASTM F963-23 §4.30, provisional) — via 16 CFR § 1250
• R13 Poison Prevention Packaging (child-resistant closures) — 16 CFR § 1700
• R14 Full-size play yards — 16 CFR § 1221
• R15 Bunk beds (guardrails + entrapment) — 16 CFR §§ 1513 / 1213
• R16 VGB pool & spa anti-entrapment drain covers — 16 CFR § 1450 (15 USC §§ 8001-8008)
• R17 Infant walker safety (ASTM F977) — 16 CFR § 1216
• R18 Decorative attachments on children's socks (provisional, § 1120 & § 1501 anchors) — 16 CFR § 1120
• R19 Children's jewelry small parts / use-and-abuse — 16 CFR §§ 1500.50-.53
• R20 Youth ATV safety (Model Y, ANSI/SVIA-1) — 16 CFR § 1420 + CPSA § 15(b)

v0 heuristic-fallback checks — still run when no real rule matched the HTS, as a static-checklist sanity pass. These are Foxtrot7's original EP-H01 through EP-H07:

• EP-H01: HTS code entered is malformed or not present in the current USITC HTS.
• EP-H02: HTS chapter is not CPSC-regulated — filing rule doesn't apply.
• EP-H03: HTS chapter IS CPSC-regulated, but the product page shows no age-grading or intended-audience label required for children's-product PGA data.
• EP-H04: No applicable-standard citation visible on the product page (e.g. no reference to ASTM F963, 16 CFR 1500, 16 CFR 1303, etc. for the chapter's expected standards).
• EP-H05: No manufacturer name/address visible in structured product data.
• EP-H06: No third-party testing lab identification in structured product data (required for CPC).
• EP-H07: No tracking label visible in product images (CPSIA §14(a)(5) requirement).

5. What this scan does NOT cover

• Does not read your actual ACE filing. We do not have broker-of-record credentials on your account.
• Does not certify a filing as compliant. That's a licensed customs broker's work under 19 CFR 111 — we are not a customs broker.
• Does not cover every CPSC safety standard — v0.7 does rule-by-rule matching for the 20 real rules listed in Section 4 (per-HTS applicability + per-rule required-evidence checklist). Outside that scope, the v0 heuristic fallback looks for the presence of standard citations, not for whether the specific standard cited is the correct one. The M1 rule engine (target Q4 2026) closes the remaining gap to ~30 real rules.
• Does not cover other PGA agencies (FDA, USDA, EPA, ATF) — those have their own PGA message sets and are outside the CPSC scope of EntryProof.
• Does not cover country-of-origin duty implications, USMCA rules-of-origin, or Section 232/301 exposure — for tariff-side exposure see TariffWatch.

6. Known false-positive and false-negative modes

False positives — a store keeps CPC / lab-report / tracking-label documentation off the public product page but includes it in the shipping docs the broker actually receives. The scan flags a missing HTML signal that doesn't reflect a real filing gap. If you get a false-positive flag, please email a product URL to hello@citationsafe.com and we'll refine the detector patterns.

False negatives — the product page cites a real-looking standard (e.g. "ASTM F963 compliant") that's actually the wrong standard for the product category; our HTML detector counts it, when a rule-engine check would flag the citation as incorrect. Closing this gap is exactly what the M1 full rule engine is for.

Fetch failures — when safeFetch can't reach the URL (bad hostname, 8-second timeout, redirect to a blocked private / cloud-metadata address, non-HTML response), the scan returns a real error message and no score. It never falls back to a fabricated score. Bogus URLs like bogus-store-example-2026.invalidsurface as "Could not scan <url> — please verify the URL is correct and publicly reachable."

7. Roadmap: from heuristic to rule engine

The v0 heuristic-only phase is deliberately conservative and honestly labeled as such. EntryProof's roadmap has the M1 rule engine at Q4 2026 target — that's when the scanner moves from "flag likely gaps" to "evaluate each product against its category-specific CPSC safety standard." Until M1 ships, the v0 phase disclosure is on every scan result UI, on this methodology page, on the product landing page, and on the roadmap. We are not claiming M1 capability from a v0 scanner.

8. Version history

• entryproof-quebec8-real-fetch-v1-2026-08-24 — current; Quebec8 real-fetch ship (Aug 24). Replaces the pre-Q8 sha256-of-URL fake scoring with real safeFetch-driven HTML fetch + 5-signal detection + 24hr canonical-URL cache. Fixes the "allbirds.com scores 64 vs www.allbirds.com scores 51" determinism bug. Signals: age-grading, CPSC-accepted lab, manufacturer info, certificate / CFR citation, Prop 65. Retains v0.7 20-rule CPSIA engine.
• entryproof-v0.7-substantial-2026-08-21 — Whiskey7 v0.7-substantial ship (Aug 21). Added 10 more real CPSIA rules (R11-R20: LHAMA, toy chest lids, PPPA, play yards, bunk beds, VGB pool, infant walkers, decorative-attachment small parts, children's jewelry small parts, youth ATV). 20 real rules total; badge upgrades to v0.7-substantial when 5+ apply on an HTS.
• entryproof-v0.5-partial-2026-08-20 — Romeo7 ship (Aug 20). First 10 real CPSIA rules (R1-R10) with verified CFR citations.
• entryproof-heuristic-v0-2026-08-20 — Papa5 ship. Added EP-H07 (CPSIA tracking-label heuristic) and honest v0-disclosure copy on the scanner.
• entryproof-heuristic-v0-2026-08-08 — Foxtrot7 initial ship with EP-H01 through EP-H06.

Back to EntryProof · Portfolio methodology · EntryProof glossary · EntryProof roadmap