Marketplace Launch Checklist — When ThoDigitals Opens to Third-Party Sellers
Internal roadmap: what must be in place BEFORE allowing third-party vendors to list products on ThoDigitals.
ThoDigitals
On this page
⚠️ Internal page — read before flipping the marketplace switch. Skipping these steps could result in legal liability, payment processor termination, or Google deindexing. Status: marketplace closed — solo seller only.
🎯 Current state
| Legal entity | Cá nhân (no registered entity) |
| Payment | Lemon Squeezy USD only (SePay disabled) |
| Sellers | 1 — ThoDigitals only |
| MOIT registration | Not required (no VN business activity, no .vn, no VN customers) |
| Marketplace mode | OFF — vendor signups closed |
🚦 When can I let other people sell?
You need all of the following before opening vendor signups:
Phase 0 — Foundation (do once, costs ~$200-500)
| Item | Cost | Time | Owner |
|---|---|---|---|
| Form legal entity (Vietnam LLC, US LLC via Stripe Atlas, or Singapore Pte Ltd) | $0-500 | 3-30 days | You |
| Get business bank account / Wise Business / Mercury | $0 | 1-7 days | You |
| Tax registration in entity's jurisdiction | $0-100 | 1-14 days | You |
| If VN entity: Đăng ký TMĐT với MOIT at online.gov.vn (Đăng ký sàn, not just Thông báo) | $0 | 10-30 days | You |
| D-U-N-S number (needed for Google publisher verification at scale) | $0 | 5-30 days | You |
| Designated DMCA agent registration (US Copyright Office) | $6 | 5 min | You |
Phase 1 — Legal docs (1 day of work)
| Document | What it covers | Status |
|---|---|---|
| /vendor-agreement | What sellers agree to: IP ownership, commission, payout, indemnification | ☐ TBD |
| /dmca | Designated agent email (dmca@thodigitals.com), takedown process, counter-notice, 3-strike repeat infringer policy | ☐ TBD |
| /acceptable-use | Banned product list: license keys, pirated software, copyrighted templates, adult content, weapons, financial advice, etc. | ☐ TBD |
| /trademark-policy | Trademark complaint process (separate from DMCA) | ☐ TBD |
| /vendor-code-of-conduct | Response SLA, no off-platform solicitation, review integrity | ☐ TBD |
| /dispute-resolution | Buyer-seller dispute process, ThoDigitals as arbitrator, refund authority | ☐ TBD |
| Update /terms with marketplace clauses (Sections 18-25) | Marketplace-specific liability, vendor responsibility, ThoDigitals platform role | ☐ TBD |
| Update /privacy to disclose vendor data flow | How buyer data is shared with vendors (email only for delivery) | ☐ TBD |
Phase 2 — Technical safeguards (1-2 weeks of dev work)
- ☐ Vendor signup flow with electronic agreement (capture IP + timestamp + checkbox)
- ☐ KYC upload — ID, bank/wallet info — stored in private bucket, only admin reads
- ☐ Manual product review queue (block new vendor listings from going live; admin approves)
- ☐ Add columns to vendor_profiles:
dmca_strikes,kyc_status,kyc_documents_url,kyc_verified_at,terms_agreed_at,terms_agreed_ip - ☐ Auto-scan listings for banned keywords (Adobe, Microsoft, Photoshop, license key, crack, nulled, leaked, etc.) → flag for review
- ☐ DMCA inbox monitor at
dmca@thodigitals.com— workflow: receive → 24-72h takedown → notify vendor → counter-notice if vendor disputes - ☐ Repeat-infringer ban automation: 3 strikes/12 months → auto-suspend vendor
- ☐ File fingerprinting on upload (SHA-256) — prevents same file being uploaded by different vendors
- ☐ Vendor payout admin panel — Net-30, minimum payout, withholding rules
- ☐ Buyer review system with vendor-can't-self-review enforcement
- ☐ Off-platform contact detection (block vendor messages containing email/phone unless escalating to support)
Phase 3 — Operational (ongoing)
- ☐ Designate one team member (or yourself) as DMCA Designated Agent — name, address, phone, email registered with US Copyright Office
- ☐ First 30 days: manually review every product from every new vendor before publishing
- ☐ Maintain a "trusted vendor" tier — vendors with 10+ sales + 0 strikes get auto-publish
- ☐ Quarterly: audit top 10 vendors for IP compliance
- ☐ Weekly DMCA inbox check (committed turnaround time matters for safe-harbor protection)
- ☐ Annual review of /acceptable-use to keep up with emerging fraud patterns (e.g., AI-generated content, NFT scams, crypto sketchiness)
🛡️ Risk-mitigation tier list (do BEFORE first vendor)
| Tier | Item | Why now (not later) |
|---|---|---|
| 🔴 P0 | Vendor Agreement live + signed-electronically by every vendor | Without this, you have no contract — you absorb all vendor liability |
| 🔴 P0 | DMCA Designated Agent registered | Without this, you lose Section 512(c) safe harbor — every infringement claim sticks to you |
| 🔴 P0 | KYC before payout | Lemon Squeezy / Wise will freeze accounts if you can't identify vendors |
| 🔴 P0 | Manual review for first 30 days per vendor | Catches 90% of pirated content + fraud before listing goes live |
| 🟡 P1 | Auto-keyword scanner | Catches obvious license-key resale ("Adobe key", "Photoshop activated") |
| 🟡 P1 | Repeat infringer ban automation | Required for safe-harbor under DMCA 512(i)(1)(A) |
| 🟢 P2 | File fingerprinting | Stops cross-vendor piracy of the same file |
| 🟢 P2 | Off-platform contact detection | Stops vendors from circumventing your commission |
💰 Realistic cost estimate
| Path | Setup cost | Ongoing/yr | Best for |
|---|---|---|---|
| VN: Hộ kinh doanh (chỉ solo seller) | ~300K VND | Thuế khoán ~3-7tr | Solo seller VN, $<30K/yr |
| VN: Công ty TNHH 1 thành viên | ~3-5tr VND | Kế toán ~10-20tr | Marketplace VN, có vendor khác |
| US LLC (Stripe Atlas) | $500 | $500-1000 (registered agent, IRS) | International marketplace, ưu tiên thuế |
| Singapore Pte Ltd | $1500-2500 | $2000-4000 | Asia-focused marketplace, exit-ready |
| Estonia e-Residency | €100 + €265/year company | ~€700 | EU customers, fully remote |
📅 Recommended timeline (if you decide to open marketplace)
- Month 0 (decision): Pick entity jurisdiction based on revenue level and customer geography
- Month 1: Form entity, open business bank, get D-U-N-S, register DMCA agent
- Month 2: Write Vendor Agreement + DMCA + Acceptable Use + Trademark + Code of Conduct + Dispute Resolution (use a lawyer for the Vendor Agreement specifically — $500-2000)
- Month 3: Build vendor signup + KYC + manual review queue
- Month 4: Soft-launch with 3-5 hand-picked vendors (closed beta)
- Month 5+: Open public vendor signups, monitor DMCA volume, refine policies
🚨 Triggers that escalate urgency
You should accelerate this checklist if:
- Someone you trust offers to list a product (don't let them — finish the docs first)
- Monthly revenue from your own products exceeds $5K (entity becomes worthwhile for tax savings)
- You receive a DMCA notice (even for your own products) — handle correctly to build a process
- A competitor marketplace launches and you want to grab market share fast (still — finish P0 items)
🔗 References
- US Copyright Office DMCA agent directory
- Cổng Đăng ký TMĐT — Bộ Công Thương VN
- Stripe Atlas (US LLC)
- Estonia e-Residency
- Lemon Squeezy Merchant of Record terms
📋 When ready, just say:
"Mở marketplace, tôi đã có pháp nhân [VN LLC / US LLC / Singapore Pte / ...]"
...and we'll execute Phase 1 (legal docs) + Phase 2 (technical safeguards) in one work session.