Every document is checked against four things.

The catalog further down lists what gets checked. This is the order it happens in: what starts each stop, what runs, and what the record holds once that stop is over.

What happens between the upload and the finding.

A certificate arrives by upload, by supplier request link, or on the API.

The file is accepted as bytes. Anything over 8 MB is refused before any work is done.

413 over 8 MB; 400 when the base64 does not decode.

A SHA-256 of the file contents is taken. That hash is the document's identity for the rest of its life: it keys the read cache, it is stored on the check record as fileHash, and it is what the reuse index compares.

The embedded text layer is pulled. Text scraped out of an image file's bytes only looks like text by length, so it is discarded rather than trusted: a real COA would otherwise score as empty and the read that could have saved it would be suppressed.

A PDF or image whose embedded text is too thin to trust.

The page itself is read. The transcription is cached on file hash plus model plus prompt hash, so a changed prompt re-reads the document instead of serving the previous reader's answer, and the read runs at temperature 0 so the same bytes give the same answer.

180 second ceiling, measured rather than guessed: a multi-page certificate needed 82.4s and a 60s ceiling turned a readable document into a false unreadable.

Transcription or text layer available.

Structured rows, document links, QR values, PDF metadata, and text, structure and visual fingerprints are derived. The fingerprints are what later documents from the same source get compared against.

The fields a complete certificate carries are read into rows: product, strength, lot, purity or assay, method, testing lab, report ID, date, sterility, endotoxin. A field the document does not state is printed as 'Not stated on the document', never guessed.

The four lanes run and each returns one state with its reason. No lane may silently disappear.

A completeness band is computed. An unresolved high-severity finding can never sit inside a 'complete' band: the band only ever tightens, so nothing that read partial can become clean.

complete requires score 80 or above, no required field absent, and no high-severity finding.

A finding is raised.

Severity decides the consequence. A high-severity finding flags the lot through the state machine and blocks the passport. Medium and low reduce the completeness score and appear as items to review before reliance.

Two ways the read ends.

The second one is the one nobody demos. A file the engine could not read is recorded as unreadable rather than reported as a document missing every field, because those fields were not absent, they were not extracted.

Uploaded in the workspace, Sent by the supplier on a request link, Posted to the API. All three land on the same read.

The embedded text layer first. When that layer is too thin to trust, the page itself is read, deterministically and with a deliberately generous time ceiling, then cached on file hash plus model plus prompt hash so the same bytes are never re-read.

One of these two

Structured rows, document links, QR values, PDF metadata, and the text, structure and visual fingerprints came off the file. The fingerprints are what later documents from the same source get compared against.

Too little was recovered from the file to form a record: not enough text, no structured rows, and no product with a quantitative result. Nothing is scored and no findings are raised; the record asks for a sharper file.

Could not read this document

Reading a document establishes what the document says. It does not establish that the document is genuine, that the lab issued it, or anything about the medicine it describes.

The check reads documentation for completeness, consistency, reuse and tamper signals. It never declares a document fake, and it cannot establish provenance unless the issuing lab records its own reply.

These are the passes that run between the read and the finding on the path above. Mechanical and repeatable, so two reviewers reach the same record and an inspector can follow it.

Document forensics

Fakes are cheap to make and expensive to catch. Every file gets a 17-signal forensic pass: reused signatures, producer anomalies, files created after their stated test date, image-editor producers, and edit-stack signals, plus signals consistent with generated documents such as C2PA content credentials and template placeholders. Always surfaced as signals, not proof.

Live source and lab checks

A recall can land months after the paperwork was filed. Lots and firms are checked against openFDA enforcement and recall records in real time, plus an FDA registration snapshot. The issuing lab is resolved against a verify-portal registry with a ready-to-send confirmation email, and only a recorded lab reply flips a document to source-confirmed.

Cross-record reuse index

The oldest trick is one real certificate reused for many lots. The same lot, report ID, file, or available visual fingerprint appearing across indexed records is surfaced as a review signal, and a supplier's new document is compared against the structure of their own prior documents to surface template drift.

Vision OCR fallback

Scans and photos are where bad documents hide, because nobody can search them. Image-heavy or scanned COAs are read with OCR so fields and signals are extracted even when there is no embedded text.

AI-assisted triage

Reading a full packet by hand takes hours, and the misses hide in the boring pages. A capped first-pass extraction drafts the field map, the conflict list, the missing-evidence list, and the supplier questions, bounded by plan limits.

A human checks written memos

Automation that quietly claims human sign-off is worse than no automation. Diligence memos, the written review reports we deliver, get a reviewer's check of the final language. Self-serve checks, ClearGate decisions, and passports resolve automatically against the policy you set, with no human sign-off claimed.

A 17-signal document-forensic pass on every file, run alongside the completeness, source-route, and cross-record lanes.

None of the six is a separate tool an operator has to run. Each one is computed on the document during the same check, and the four lanes below are rolled up from what those passes produced.

Not one read of one file. Each document is reconciled against the lab that issued it, the standard it has to meet, the file's own internals, and every other document we have seen. Findings are signals for human review, never approval or safety claims.

Evidence scanner

The sweep moves only while a lane is working, then stops on the resolved state.

• Issuing labReconciled against the issuing lab
• StandardChecked against the standard
• File internalsChecked against the file itself
• NetworkChecked against every other document seen

Issuing lab: reconciled against the issuing lab.

Each lane returns one of three results: ran, not applicable, or could not verify. No lane is ever allowed to disappear. Findings are signals for human review, never approval or a safety claim.

Local sample data. Not a live account. Every supplier, lot, order, and document shown here is fictional.

Reconciled against the issuing lab

We resolve the issuing lab against a verify-portal registry and generate a ready-to-send confirmation email. A recorded lab reply is the only thing that flips a document to source-confirmed, and a lab's denial that it issued the report is the loudest flag in the product.

Checked against the standard

When route and dose are on file, we compute the dose-based bacterial endotoxin limit (the USP <85> approach) and compare it to what the certificate states. We check stated residual solvents against ICH Q3C limits, flag high purity paired with low net peptide content, and flag an undisclosed salt form on a peptide COA.

Checked against the file itself

We read the PDF's own metadata and flag a file created after its stated test date, image-editor producers, and edit stacks. We note when chromatography results are stated but no trace is attached.

Checked against every other document seen

The same lot number appearing elsewhere with different values triggers a private alert, with no identities shared. A supplier's new document is compared against the structure of their own prior documents, so template drift surfaces.

No lane is allowed to disappear.

Every accepted document reports an explicit state for all four lanes. A lane that had nothing to work with says so; it never goes quiet and it never borrows another lane's result.

Its read rows: product, strength, lot, purity or assay, method, testing lab, report ID, date, sterility, endotoxin. A field the document does not state is printed as not stated, never guessed.

The lab that issued it, the standard it has to meet, the file's own internals, and every other document on record. One state out of each lane, every time.

Each lane ends in one of these

The lane produced a result on this document. Anything it found enters the record as a finding, and the severity of that finding decides what happens next. Ran says the lane produced a result, never that the result was clean.

The document gives the lane nothing to check: no issuing laboratory named on it, no standard-bound value stated, or an upload that is not a PDF and so carries no embedded file metadata. The lane stays on the record with its reason rather than vanishing.

The lane was attempted but lacked an input, a reply, or a history. It is neither a confirmation nor a failure: the issuing-lab lane stays unconfirmed until the lab's own reply is recorded, and the cross-record lane arms as the record grows.

A lane reads Ran only when it actually produced a result, and anything outside the three states is recorded as Could not verify rather than guessed at. A mislabelled Ran would be a false claim about what was checked, which is the one thing an evidence record cannot survive.

Then something comes out.

The four states describe what was checked. Three other things describe what was found, and those are what actually move a lot.

A completeness band

Complete, partial, sparse, or undocumented. Complete requires a score of 80 or above, no required field absent, and no high-severity finding. The band only ever tightens, so nothing that read partial can quietly become clean.

A finding, with a severity

A high-severity finding flags the lot and blocks its Evidence Passport. Medium and low reduce the completeness score and stand as items to review before anyone relies on the document.

A lot, re-read across its whole document set

The check is saved against the lot it describes, and the release gate re-evaluates that lot's whole document set for its subject and dosage form, not just the newest file. A single-panel certificate does not clear a lot on its own; several certificates together can.

This is what the passes above look for, one row at a time. Presence or absence is recorded mechanically. Serious findings route for human review on a memo, and every row below is a signal for your review, never a determination.

A 17-signal document-forensic pass on every file, run alongside the completeness, source-route, and cross-record lanes.

The Lane column here is the published signal grouping the forensic pass uses. It is a different axis from the four check lanes above, which report what each document was reconciled against.

This page publishes what we check and the public sources we check it against. The detection heuristics themselves are intentionally unpublished, both because publishing them would help fraudulent documents evade them, and because they evolve faster than any page.

Then it ends in an action.

The predictive read

A document's gaps are mapped against the stated reasons in real FDA recall records, its completeness is placed as a percentile against comparable documents, and the record carries the supplier's trajectory and a time-to-stale estimate.

The next step, prefilled

Every read ends in an action: a prefilled corrected-COA request that asks only for what is genuinely missing, and a recommendation for independent ISO/IEC 17025 lab testing when documentation cannot resolve the question.

Source-style evidence categories, captured with the search, the source URL, and the capture date preserved for the record.

openFDA enforcement and recall records

Lots and firms are matched against open enforcement and recall data in real time.

FDA registration snapshot

Manufacturer identity is checked against a dated registration snapshot, and unmatched names are surfaced for review.

503B registered-facility list

A dated capture of the FDA outsourcing-facility list, shown with both its source date and its capture date.

FDA, openFDA, import-alert, NDC, and lab-verify lanes preserve the search, source URL, capture date, and reviewer context.

DMF and LOA, NDC and listing relevance, and cGMP evidence categories are tracked as rows, not as a verdict.

FDA's list current as of June 23, 2026, captured June 30, 2026

Not found in the snapshot never means not registered. It means the name did not match the captured list.

What lands here after the packet is filed.

These lanes keep running after a packet is filed, which is where the signals on this surface come from. A sweep pulls recent FDA enforcement records, scans each one for lot numbers the system already knows, and requires a token-boundary match so a short number can never match inside a longer one.

The severity chip

Alert severity is its own axis: Action needed, Attention, Informational. It says something changed and someone should look at it. It is not an evidence posture, a policy decision, or a receiving disposition.

The identifier and scope line

Each row names the supplier, lot, or order the captured record touches. The fan-out is private and deduped: an account is notified about its own lots only, and a given account, lot and recall fires once.

The closing note

What a signal does change is narrow and automatic: a lot named in an enforcement record carries the recall signal, every Evidence Passport minted from that lot is stamped with a post-release signal, and no new passport can release from it. Reaching the people holding the product stays the operator's call; the software does not send to patients on its own.

Alerts

Verification route unreachable

BlueRiver API Co · the published verify link for LOT-BR-0816 did not answer on three attempts. A corrected source route has been requested.

MON-DEMO-18·1 supplier · 1 lot · 1 order

Sterility scope gap on an open lot

Keystone Peptide Labs · LOT-KP-2407 carries no sterility or endotoxin result. Missing evidence is not a failed test; the lot stays in review until it lands.

MON-DEMO-21·1 supplier · 1 lot

Public-source snapshot refreshed

openFDA enforcement and recall records re-captured for 4 suppliers. No match in the captured sources. Disposition unchanged.

Qualification element falls due

Aurora Pharma Supply · ongoing review is due July 30, 2026. Five of six elements remain on file with current dates.

A monitoring signal maps a captured public record to the suppliers, lots, and orders it touches. It never changes a disposition on its own, and no match in a captured source is not proof of absence.

The same reader, given the same packet, cannot see across every other packet. That is the difference the engine makes.

Where the machine stops

Every element on a record is labelled with where its evidence came from, so the file never overstates what was checked.

Veritura evaluated

Read from the document or from a public source. The engine saw it itself.

Operator attested

You confirm what we cannot read. The file records that it was attested, not evaluated.

Source-confirmed

A recorded reply from the issuing lab. Nothing else flips a document to this label.

Human-reviewed

A reviewer checked the final language on a delivered diligence memo.

Signals are for your review. Veritura never calls a document fake and never makes an approval or safety claim.

AI may assist extraction and drafting. Delivered written diligence memos receive human QA. Self-serve checks, ClearGate decisions, and Passports are automated unless the record explicitly says otherwise, and no human sign-off is claimed on them.

Veritura does not test medicine, approve suppliers, recommend purchases, or make medical, legal, product-safety, or FDA-approval determinations. There is no paid or subjective placement: suppliers cannot pay for a better result or a better position, no listing fee, no subscription, and no pay-to-rank. Where results are ordered rather than filtered, the order is set by a published documentation-coverage grade, and that grade is never a recommendation, a preference, or a statement about any product.

A result is a documentation posture of Clear, Review, or Hold on the document set. A ClearGate decision of Allow, Review, or Hold is a separate axis, resolving one order against the policy you configure. Both describe the paperwork, not the medicine.

Absence of a public match is not proof of absence. A missing document is not a failed test. A similarity indicator is not a fraud determination.

Create a workspace and check a document, or talk to us about your supplier base.