SoftSquare Shipping Gateway for WooCommerce

Description

SoftSquare Shipping Gateway for WooCommerce is a TCS Pakistan shipping plugin that connects your WooCommerce store to TCS for shipment booking, shipment tracking, shipping label generation, COD delivery, and day-to-day shipment management, without anyone retyping an address into a courier portal.

This is an independent third-party integration developed and maintained by SoftSquare. It is not affiliated with, endorsed by, sponsored by, or officially supported by TCS. TCS is a trademark of its respective owner and is used here only to describe the courier this plugin connects WooCommerce to.

This plugin does not talk to TCS directly. It sends orders to the SoftSquare service, which holds your TCS credentials and makes the courier calls on your behalf. That service is required — without it the plugin cannot book, print or track anything. See External Services below for exactly what is sent and when.

Features

Everything listed here is implemented in the plugin. Nothing is planned or partial.

• Book a TCS shipment directly from a WooCommerce order, or automatically when an order reaches a status you choose
• Cancel a TCS booking, re-book it with corrected details, or book a TCS reverse pickup
• TCS COD (cash-on-delivery) support, with the amount to collect taken from the order total or set per order
• Generate and print a TCS shipping label (consignment note) as a PDF, stored locally so reprints are instant
• Bulk-book TCS shipments and bulk-print TCS shipping labels from the orders list
• Track a TCS consignment from the WooCommerce order screen, and from a public TCS tracking page via the [tcs_tracking] shortcode
• Hourly TCS shipment status refresh, plus a signed webhook the service can call the moment a status changes
• Move the WooCommerce order status automatically when TCS delivers or returns a parcel
• Email the customer, the store, or both when a TCS shipment’s status changes, optionally through your own SMTP server
• A searchable list of TCS Pakistan destinations at checkout, bundled with the plugin, so every order carries a station code TCS recognises
• Enter and test your TCS account credentials from the WooCommerce settings screen
• An activity log of every call the site makes to the SoftSquare/TCS gateway, with credentials redacted

Configuration

All settings for connecting WooCommerce to TCS Pakistan live under SoftSquare Shipping → Settings in the WordPress admin.

• TCS account — your API username, password and bearer token, your TCS account number and cost centre. These are issued by TCS, not by SoftSquare or by this plugin.
• Collection address — where parcels are picked up from. A booking is refused without it.
• Booking defaults — service code, currency, default weight, what goes in the content description.
• Store behaviour — which payment methods count as COD, which order statuses trigger an automatic booking, whether to show the TCS city field at checkout.
• Status emails and Sending mail (SMTP) — who is told when a parcel moves, and which mail server sends it.

Press Test connection after saving. It asks the service to authenticate against TCS there and then, and reports what TCS said.

Usage

Open any WooCommerce order. The TCS shipment panel on the right will book the parcel, and from then on shows the consignment number, the current status and a button to print the consignment note.

To book several at once, tick them in the orders list and choose Book with TCS from the bulk actions menu.

For customers, put the [tcs_tracking] shortcode on a page. Activating the plugin creates a draft page called Track your order containing it; publish that page to turn it on. The shortcode accepts [tcs_tracking accent="#7b2d52" width="900px"] if you want it to match your theme more closely than it manages on its own.

External Services

This plugin relies on one external service and cannot work without it.

Service: SoftSquare Shipping Gateway
Operated by: SoftSquare
Endpoint: https://app.softsquare.io

Why it is used. The service holds your TCS credentials and performs the courier API calls. Your WordPress site never contacts TCS directly. This exists so that one set of courier credentials can serve a store without those credentials being used from the store’s own server.

What is sent, and when.

When you press “Connect this site” under SoftSquare Shipping → Settings: the site URL and its domain, so the service can register the site and issue a signing secret. The service then fetches a one-time random token back from this site to prove the domain is yours. Nothing is sent to SoftSquare before you press this button.

When you save the settings screen: the TCS credentials you entered (API username, password, bearer token), your TCS account number, customer number and cost centre code, your collection address (name, street address, postcode, city, country, mobile number), and your booking defaults. This is the only time credentials are transmitted, and only because you pressed Save.

When an order is booked — either by pressing Book, by a bulk action, or automatically when an order reaches a status you configured: the order number and reference, and for the recipient: first and last name, full shipping address including city, postcode and country, phone number, and email address. Also the COD amount, order total, currency, parcel weight and piece count, service code, cost centre, and a description of the contents. If “Include SKUs” is on, each line item’s description, quantity, unit price and SKU are included.

When you print a label: the consignment number.

When you track a parcel, and hourly for parcels still in transit: the consignment number.

When a visitor uses the tracking shortcode: only the consignment number they typed. No customer or order data is sent for a public tracking lookup.

When you cancel, re-book or book a reverse pickup: the consignment number, and for a re-booking the same order data as the original booking.

No analytics, usage statistics or telemetry are sent. No data is sent on a schedule except the hourly status check described above, which carries consignment numbers only.

Terms of service: https://softsquare.io/wp-term
Privacy policy: https://softsquare.io/wp-privacy

Privacy

This plugin transmits personal data belonging to your customers — name, address, phone number and email — to the SoftSquare service, which passes what TCS needs to TCS in order to have the parcel collected and delivered. This is the purpose of the plugin and cannot be switched off while still booking shipments.

Data is only ever sent as a result of an action you or your configuration initiated: pressing Book, running a bulk action, saving settings, or an order reaching a status you chose to auto-book on. Nothing is sent when a customer simply places an order unless you turned automatic booking on.

If you are subject to GDPR or a similar regime, you should name SoftSquare as a processor in your privacy policy, alongside TCS as the carrier.

Stored on your own site: an activity log of every call made to the service, with credentials redacted but the rest of the request and response kept as sent — so a booking call’s log entry includes the same recipient name, address, phone number and order details that went to the gateway. This log is only visible to users who can manage WooCommerce, is kept for 30 days by default (configurable), and can be cleared at any time from SoftSquare Shipping → Activity log. Also stored: consignment numbers and courier status against each order; and label PDFs in wp-content/uploads/ssg-labels/, protected by a random filename and served only to users who can already view the order. Uninstalling deletes the settings, the activity log and the stored labels. Consignment numbers on orders are kept, because they are the record of a real shipment.

Security

TCS credentials are entered by the merchant and stored in the WordPress options table with the plugin’s other settings. They are sent to the SoftSquare service over HTTPS when you save the settings screen, and are held there — the plugin does not need them again to book a parcel.

Credentials are never printed in full in the admin. A saved value shows only its length, and for the bearer token the first and last few characters, which is enough to tell a wrong credential from one that was truncated on the way in. Credentials are stripped from the activity log before it is written, and never appear in an error message shown to a customer.

Requests from this site to the service are signed with HMAC-SHA256. The webhook the service calls back on is signed the same way and verified with hash_equals before anything is acted on.

No credentials are hard-coded anywhere in this plugin.

Credits

Developed and maintained by SoftSquare — https://softsquare.io/

TCS is a trademark of its respective owner. SoftSquare Shipping Gateway for WooCommerce is an independent third-party integration and is not affiliated with, endorsed by, sponsored by, or officially supported by TCS.

Technical details