Evidence Passport: Every order gets its own proof, issued only from a cleared lot.
Signed per order. Bound to its lot.
Release, before a Passport issues: what is ready, what is waiting, and every item that still stands in the way. Brennick Compounding is a sample pharmacy; its suppliers, people, lots and figures are invented.
A Passport is issued from a lot, never from a claim.
One Passport per dispensed order, signed by a person. The patient reads the certificate's own lines, and anyone can check the fingerprint.
Shipped, checked, signed, issued. Bound to its lot for good.
A refusal names the requirement that was not met, in words a reviewer can act on.
The release gate, in full- An order ships
From the workspace, a watched folder or the API. A lot number that matches several lots is refused.
The order, tied to one lot - The floor is checked
On the server, every time: the lot is cleared, carries no hold or recall, and a named person reviewed it.
Or a refusal that names why - A person signs
Issued by hand, a Passport needs a signature, and an unsigned attempt is refused: "Not signed, nothing saved". A saved Standard or Lenient policy lets a reviewed lot issue without signing each one.
A signed decision, kept - Bound to its lot
The binding is never rewritten. A recall signal months later still stamps every Passport issued from the lot.
A record that follows the lot - The patient receives it
As a link by email, or from the Veritura Seal on the unit, whose scan links the released record.
Matched to their own order
One record, three depths. Patient, clinic, inspector.
The same lot record serves the patient, the clinic and the inspector. What changes is how much of it each one sees.
Fourteen allowlisted fields, the release gates and the fingerprint. Never a score, or anyone's identity.
The released record and its order reference, verified with no account. Never internal notes or pricing.
The full trail, each value cited to its line, every decision with who, when and why.
From a cleared lot to the patient holding the medicine.
Order ORD-60412: Cyanocobalamin 1,000 mcg/mL from lot BM-5520, released by Dana Reyes, PharmD.
What the patient reads, field by field.
The certificate line by line, from a fixed list of fourteen fields. For a compounded preparation, each ingredient, up to twelve, with its lot, its supplier and its own results.
- Fourteen fields, from a fixed list
- Every ingredient, with its results
- The supply chain, shown by role
- A fingerprint anyone can recompute
Eight ways a release stops.
Release is not a status a person sets. It is a gate on the server with eight reasons to refuse: a recall signal, an open hold, no 503A route, a held or unreviewed ingredient lot, an uncleared lot, no certificate read, or no person review.
- A gate on the server, on every path
- Every refusal names its reason
- No signature, no Passport
What never reaches the patient.
No score, band or posture word appears on anything a patient sees. The patient's page says what paperwork was checked, never that the medicine was tested.
- No notes, pricing or supplier language
- No patient identity
- A declared recall, with who declared it
Your order system stays the source of truth.
Veritura attaches the evidence layer per order and replaces nothing. The Passport carries your order reference, so the holder can match it against their own packing slip. That match turns a unit of this lot into the unit released for their order.
- Attached per order, never a replacement
- From the workspace, a watched folder or the API
- A reference that reads like patient data is refused
Checked before it issues. Watched after.
fields the patient reads, from a fixed list and nothing outside it
reasons the server refuses a release, each one named
ingredients at most, each with its own lot and results
re-match of lots on file against openFDA enforcement records
A Passport publishes what a lot's documentation states and where it came from. It is not a statement about the medicine.
The full detail.
Every rule, for the reader who wants it before a call.
See a sample Evidence PassportHow a Passport is issued, step by step
- An order ships
- From the workspace, a watched folder or the API, with its lot number. The lot is resolved by number within the account; a lot number that matches several lots is refused, never guessed.
- The floor is checked on the server
- The lot exists and is cleared, carries no hold and no recall signal, a named person has reviewed it, and any requirement your policy adds is met.
- An order that arrives early
- An order that arrives before its lot clears waits rather than releasing on its own say-so; nothing is lost and nothing is published.
- A signature
- A Passport issued by hand needs a signature, and an unsigned attempt is refused with the words "Not signed, nothing saved". A saved Standard or Lenient policy lets a lot a person reviewed issue its Passports without signing each one.
- When it issues
- A passport.issued event fires to any subscribed endpoint, signed with an HMAC over the body. Internal, loopback, link-local and private addresses are refused as webhook targets.
The eight reasons a release stops 8 reasons
- Recall and holds
- A recall signal; a person's open hold; an ingredient lot that is held.
- The route
- No 503A route.
- The lot itself
- The lot not cleared; no person review.
- Its ingredients
- An ingredient lot nobody reviewed; a purchased lot with no certificate read against it.
- Every refusal
- Names the requirement that was not met, in words a reviewer can act on.
What the public Passport shows 14 fields
- The certificate, line by line
- Strength, sample amount tested, assay or purity, identity, sterility, bacterial endotoxin, pH, appearance, particulate matter, test method, testing laboratory, the date on the certificate, the date recorded as expiry, and the manufacturer, each as the laboratory printed it with the limit beside the result. Nothing outside the list is shown.
- Every ingredient
- Up to twelve for a compounded preparation, each with its lot, its maker and supplier, when it was received, read and reviewed, what FDA's registries returned with their dates, and its own results as its certificate printed them, with its retest date and test method.
- The supply chain, by role
- Only the parties the paperwork names, from the manufacturer to the dispensing pharmacy.
- The release gates
- The published gates every release clears, six for a purchased lot and seven for a preparation, so the reader knows what was checked before the medicine left.
- A fingerprint to recompute
- A SHA-256 over the record's fields in a fixed order. The browser recomputes it locally and compares it with the one printed.
- Values as printed
- Every reported value is shown exactly as the certificate documents it. Veritura reads and records the values; it does not perform or repeat any test.
The lot binding, and what a later signal does
- The binding
- A Passport is bound to its lot at issue and the binding is never rewritten.
- The hourly re-match
- Lots on file are re-matched against openFDA enforcement records on an hourly cycle in production. A match holds the lot, stamps every Passport issued from it with a post-release signal, and stops any new Passport from issuing.
- Who is told
- Each affected account is told privately about its own lots only, once per account, lot and record.
- What a match means
- A lot-number match against public enforcement data is a documentation signal, never a safety or approval determination. A lot number can be reused across firms, so the firm and the lot are confirmed against the FDA record.
- A declared recall
- A recall a person declares appears on the scan page and the Passport, attributed to who declared it, and reaches every patient who saved a unit from the lot.
Saving a unit, and who can be reached
- An email only
- A patient who scans can save the unit with only an email. The claim starts pending and only the emailed link activates it, so nobody is added to a list they did not ask for.
- Limits
- At most five live claims may sit on one serial, and one email may make at most ten claim requests a day.
- What the patient's record holds
- Their email, the saved serials and the notices sent about them, until they delete it.
Verify it yourself, and how it is charged
- Verify
- Every released record resolves from its own verify address, with no account. The browser recomputes the SHA-256 fingerprint over the record's fields, in their fixed order, using its own WebCrypto, and compares the result with the fingerprint printed on the record. A link with no released record behind it says so.
- Charged
- Once per order when selected, never per unit, label or scan. Scans and reprints are free, and sandbox records are free for testing.
Veritura does not test medicine, approve suppliers or make medical, safety or FDA-approval determinations. No match in a public source is not proof of absence. Questions about treatment stay with the pharmacy or prescriber who dispensed it.
Questions, answered plainly.
Only from a cleared lot that a named person has reviewed, and with a signature when issued by hand. One Passport covers one dispensed order, and a refusal names the requirement that was not met rather than failing quietly.
The certificate's own lines from a fixed list of fourteen fields, each ingredient with its results, the supply chain by role, the release gates and a fingerprint, in plain words with no score and no patient identity.
The lot binding is permanent. A recall signal on the lot stamps every Passport issued from it, and no new one can issue. A recall a person declares appears on the scan and Passport pages, attributed to who declared it, and reaches every patient who saved one or was emailed the Passport, with no name entering the pharmacy's or the clinic's record.
Yes, with no account. The public verify page resolves a released record, and the browser recomputes its fingerprint locally and compares it with the one printed.
Once per order when selected, never per unit, label or scan. Scans and reprints are free, and sandbox records are free for testing.
Still have questions? Talk to a person.