The machine checks Checkbox runs at each lifecycle stage, what pass, fail, needs_review and not_applicable mean, and how the compliance status is computed.

A check verifies one observable thing — "the consent checkbox is not pre-checked", "a trial reminder arrived inside the window". Checks are implemented once and reused by every law that requires the same thing; the catalog maps requirements to checks.

#Verdicts

A preflight result's verdict is the worst status among its checks: fail > needs_review > pass (not_applicable when nothing applies).

#Status labels

Every verdict also carries a user-facing compliance_status that says what to do about it. The machine status above never changes; the label is computed from it, from the evidence and from the reason Checkbox gave.

Sites, evaluations, plans and check results roll these up over the required checks: needs_fix if any check needs a fix, else your_call if a decision is open, else compliant — "Compliant · 2 live checks pending".

#Protection levels

Every check and plan task has a tier: required (the legal floor; the only tier that can make a site not compliant), recommended (clearer records beyond the legal floor, conversion-neutral: consent receipts, a cancellation confirmation email, the billing portal's cancel switch, a renewal section in your Terms) and extra (a checkbox per term, a pre-purchase summary). A site's protection_level decides what the plan lists: minimum (required only), balanced (default: required plus recommended suggestions, collapsed, never blocking) or maximum (everything). See Compliant checkouts that convert.

#Evidence sources

#Every check

#Sign-up

#Acknowledgment

#Reminders

#Cancellation

#Billing settings

#Severity, status and certificates

Each finding's severity is the strictest among the requirements that use the check: critical, high, medium or low. A site has one status: Compliant (optionally "· N live checks pending"), Needs a fix, Not set up yet, Not checked yet or Your call, counted in tasks (compliance.label, e.g. "2 fixes needed · 1 to set up"). What to do next is one to-do list: the compliance plan's ordered open tasks, the same in the dashboard, emails, MCP and the CLI. Findings are the evidence behind each task. There is no numeric score. A monitoring certificate uses a stricter tier: no critical or high check fails, no critical check is left at needs_review, and no high-severity obligation is without any evidence. A "live check pending" counts as compliant on your dashboard (its content passed), but not toward a certificate until it is observed live.

#Reproducibility

Every result records rules_version, catalog_version and catalog_hash. Preflight checks are deterministic: the same input and the same as_of date give the same verdicts.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). You remain solely responsible for your subscription program, and Checkbox takes on no legal liability for it (Terms). Checkbox is a System1 company; Trust center · Status. For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.