Evidence Passport
Every client order gets its own proof record.
One record per order, binding it to the product, lot, COA, supplier packet and reviewer behind it. It publishes only from a lot that has cleared its documentation, and it stays bound to that lot afterwards.
What it looks like
The record a person actually opens.
One lot, one order, and the documents behind them. The completeness read is stated in plain words with no score, every reported value is shown as the certificate documents it, and the limits are on the face of the card rather than in a footnote.
The same record serves a patient who scanned a vial and a buyer who was sent a link. What changes between them is nothing.
Evidence Passport
veritura.co/verify
Serial
V-SBX-00013
Documentation
Documentation reads complete
Every required field was present on the documents for this lot, and no serious finding stood against them. A paperwork read, never a statement that the medicine is safe, effective, or approved.
- Preparation
- Semaglutide (base) API
- Lot
- LOT-7741-A
- Quantity
- 250 g
- Supplier
- Aurora Pharma Supply
- Received
- July 22, 2026
- Released
- July 23, 2026
As documented on the certificate
- Identity
- Conforms
- Purity (HPLC)
- 98.7%
- Endotoxin
- Below limit
- Sterility
- Not applicable
Values as printed by the issuing laboratory. Veritura reads and records them. It does not perform or repeat any test.
Where each line came from
- Certificate of analysisSource-confirmed
- Certificate of conformanceVeritura evaluated
- Safety data sheetVeritura evaluated
Documents on file
6
Notices on this lot
None published
Veritura reads documentation. It does not grade the medicine, approve a supplier, or certify a product. Questions about your treatment stay with the pharmacy or prescriber who dispensed it.
Local sample data. Not a live account. Every supplier, lot, order, and document shown here is fictional.
How a passport is issued
A passport is minted from a lot, never from a claim.
Six steps run between the order shipping and a buyer opening the link. The cleared lot is the gate at step two, which is why an uncleared lot can never publish one.
- Operator
An order ships, from the workspace or from the API.
The order is written with its lot number. The lot is resolved by number within the account and stamped as an exact reference. An ambiguous lot number matching several lots is refused, never guessed.
Record state: Passport record created - Engine
Release is attempted.
The floor is checked: the lot must exist, be cleared, carry no ClearGate hold and no recall signal, and satisfy any human-review or ClearGate-Allow requirement the policy sets.
A live recall blocks the mint on its own, independent of state, so the gate never rests solely on clearGateHold.
Record state: Release authorized, or a 409 naming the unmet requirement - Engine
The order arrived before its lot cleared.
The order parks rather than releasing on its own say-so. Nothing is lost and nothing is published.
Record state: source_review - Your policy
The lot clears: the source is named, the missing document lands, the receiving gate passes.
When the account's policy authorizes unattended release, the parked order releases through the same sanctioned path, stamped with the exact policy id and version that authorized it and the lot evidence it rested on.
Bounded per sweep and per account, and billed through the same idempotent ledger, so a backlog clearing at once cannot produce a wave of duplicate charges.
Record state: released, with releasedBy naming the policy - Patient or buyer
The buyer or patient opens the shared record.
The public page prints the read, the lab and the date. It states documentation completeness in plain words and no number.
Never Clear, Review or Hold. See CUSTOMER_BAND_VOCABULARY.
Record state: Published at /verify/<publicShareId> - Engine
A passport is issued.
A passport.issued event fires to any subscribed endpoint, signed with an HMAC over the body. Internal, loopback, link-local and private targets are refused outright.
Record state: Delivered, or the endpoint was refused
An Evidence Passport publishes what the documentation for a lot states and where it came from. It is not a certificate of quality, an approval, or a statement about the medicine.
What the record binds, link by link.
Eight links, and the field each one stores. The lot binding is permanent, which is the only reason a recall published months after release can still reach an issued passport.
01
Client
Workspace or account. A lot number resolves within the account, and a number matching several lots is refused rather than guessed.
02
Order
orderId and customerRef. A customer reference that reads like patient information is rejected outright.
03
API / product
supplierName and productName: the identity of what shipped, as the record states it.
04
Lot
sourceLotId, bound permanently. This is the link a later recall travels along to reach a record already issued.
05
COA
coaId, reportId and labName, plus the file, text, structure and visual fingerprints, so reuse of one certificate across lots stays visible.
06
Supplier packet
supplierPacketId and memoId: the qualification file and the diligence memo the release rested on.
07
Reviewer
reviewer, and the release authority itself. A lot a person reviewed stamps human_reviewed_lot rather than auto_cleared_lot.
08
Passport
publicShareId and unitCount: the public reference at /verify/<publicShareId>, and how many physical units it covers.
Source-of-record model
The client's order system stays the source of truth.
Veritura attaches the evidence layer per order. It does not replace procurement, inventory, pharmacy, ecommerce, or ERP records.
CSV, API, or partner intake should pass the same core fields: client, order, API/product, lot, COA, supplier packet, reviewer, and release status.
Passport output standard
Order traceability should read like an operating record, not a data dump.
Every customer-safe passport and internal traceability record follows the same release contract: verdict, evidence chain, replay, boundary, next action, and export package.
Executive verdict
Released, blocked, source-review, or human-QA required. This is the record's release state, not an evidence posture and not a ClearGate decision.
Evidence map
Order, API/product, lot, COA, supplier packet, reviewer, and source file.
Evidence replay
Source intake, extraction, reconciliation, QA, release, and archive state.
Risk boundary
Documentation evidence only. No product-quality or supplier-approval claim.
Next action
Attach missing file, ask supplier, release customer link, or hold reliance.
Export package
Passport link, evidence room, audit trail, weekly rollup, and usage event.
Release rule
Customer-safe only after QA
Internal notes, pricing, supplier approval language, and private account context are filtered before release.
Six ways a release stops.
Release is not a status a person sets. It is a gate, and a refusal comes back naming the requirement that was not met rather than failing quietly.
| Code | What the release attempt gets back |
|---|---|
| lot_missing | This passport has no cleared lot on record. A passport releases only from a cleared lot. |
| recall_exposure | This lot carries an FDA recall/enforcement signal and cannot be released. |
| cleargate_hold | This lot is on a ClearGate hold. Resolve the ClearGate decision before releasing. |
| lot_pending_review | This lot is not cleared. Resolve its diligence before releasing. |
| needs_human_review | Your policy requires a human-reviewed lot before release. |
| cleargate_required | Your ClearGate policy requires a ClearGate Allow on this lot before release. |
One floor governs the mint route, the operator release route and the unattended rail alike, so nothing releases around it. A live recall signal blocks the mint on its own, independent of every other state on the record.
Every passport should show how proof became safe to release.
Replay the path from client order event to source attachment, field extraction, reconciliation, memo QA, customer-safe release, and archive state.
| Step | Stage | Where the evidence comes from |
|---|---|---|
| 01 | Order event | Client source system |
| 02 | Source attachment | Evidence intake |
| 03 | Field extraction | Veritura parser |
| 04 | Reconciliation | Diligence memo |
| 05 | Human QA | Memo QA gate |
| 06 | Customer-safe output | Evidence Passport |
| 07 | Archive and usage | Usage guard |
If the source-to-decision path cannot be explained, the passport stays in operator review.
Boundary
AI may assist extraction and drafting. Delivered written diligence memos receive human QA. Self-serve checks, ClearGate decisions, and Passports are automated unless the record explicitly says otherwise, and no human sign-off is claimed on them.
Who reads it
One record, three readers.
The person holding the vial and the pharmacist answering for it want the same facts at very different depths, so the audit-grade detail is one tap away rather than deleted.
Evidence Passport
Semaglutide (base) API
Evidence posture
Evidence posture: ClearThe document set met the configured policy. It describes the paperwork, not the medicine.
Certificate of analysis
Source-confirmedThe issuing laboratory confirmed issuance through the recorded verification route.
- Order
- PO-DEMO-0413
- Lot
- LOT-7741-A
- Supplier
- Aurora Pharma Supply
- Quantity
- 250 g
- Received
- July 22, 2026
- Released
- July 23, 2026
- Passport issued
- July 23, 2026
- Methodology
- v1.0 · April 30, 2026
Documents on file
6
- Source-confirmed
Certificate of analysis
COA-7741-A.pdf · Issuing laboratory confirmed issuance through the recorded route
- Veritura evaluated
Certificate of conformance
CoC-7741.pdf · Required identity, lot, and date fields present
- Veritura evaluated
Safety data sheet
SDS-SEMA-04.pdf · Current revision on file
- Operator attested
GMP certificate
GMP-AUR-2026.pdf · Supplied by the operator
- Operator attested
Receiving inspection
Recorded in workspace · Container and label checked at receipt
- Veritura evaluated
Shipment label
LBL-7741-A.jpg · Lot identifier matches the certificate of analysis
What this record does not establish
- Documentation diligence only. No product was tested and no supplier was approved.
- Absence of a public-source match is not proof of absence.
- Produced under methodology v1.0, April 30, 2026.
The workspace record, region by region.
This is the operator's view of one released passport. Every panel on it answers a different question, and two of them are on different axes that look alike until you read the label above them.
Evidence posture
The document set for this lot, in the workspace's own vocabulary. Only a complete read with a named supplier and lot number reaches this state; anything thin, unreadable or unidentified stays pending, and one high-severity finding is enough to flag it.
Evidence posture: Clear
Certificate of analysis
Evidence origin, which is provenance rather than a verdict, so it carries no status dot at all. Source-confirmed is set by one thing only: the issuing laboratory's own recorded reply.
Evidence origin: Source-confirmed
The identity row
Order, lot, supplier and quantity, then the dates the lot was received and released and the passport issued, stamped with the methodology version the read ran under.
Documents on file
Each document with the origin that established it. The record binds coaId, reportId and labName alongside the file, text, structure and visual fingerprints, which is what makes one certificate reused across two lots visible at all.
What a patient sees instead
This panel is the workspace. The public page a patient opens states documentation completeness in plain words and prints no number, and the workspace posture vocabulary above never appears on it.
Shown to the patient or buyer: Documentation reads complete
What this record does not establish
Part of the record, not fine print under it. The shipping product renders it inside the passport at the same size as the evidence above it, and this page reproduces it the same way.
An Evidence Passport publishes what the documentation for a lot states and where it came from. It is not a certificate of quality, an approval, or a statement about the medicine.
What the customer surface prints.
A patient scanning a vial and a buyer opening a shared link read the same document set as the workspace does, in four plain-language lines computed from the same read.
- Documentation reads complete
- Every required field was present and no high-severity finding stood against the document set. The customer page states this in words and shows no number.
- Documentation has gaps
- The partial and the sparse band both print this one line. The band only ever tightens, so nothing that read partial can later be shown as clean.
- Largely undocumented
- Almost nothing a certificate is expected to state was recovered from the document.
- Could not read this document
- Too little was recovered from the file to form a record. Nothing is scored and no gaps are raised, because those fields were not absent, they were not extracted.
The patient page prints the band in words and no numeric score. A number beside the name of someone's medicine reads as a quality grade, which it is not.
A paperwork-completeness read, never a product-quality or safety determination.
Patient
What the paperwork says about your batch.
This page shows what the paperwork for your batch says, checked by Veritura, which is independent of the pharmacy and the supplier.
- Notices on file. Where none have been published, the page says so and says that Veritura keeps watching public FDA recall and enforcement notices naming this supplier. Where one has, it states what was found, says plainly that it may or may not involve this batch, and hands the question to the pharmacy that dispensed it.
- What the lab measured. Each test, the limit the lab itself printed beside it, and whether the result was within the limit, outside the limit, or not compared when the units differ or no limit was printed on the document.
- Who handled it. The supply chain as a run of named hands, naming only the parties the paperwork names.
- Questions about your medicine. Talk to the pharmacy that dispensed it, or your prescriber, with the contact route shown only where the pharmacy published one.
- No number. A completeness score printed next to the name of someone's medication invites arithmetic about their treatment, so the patient view carries the band in words and no score.
Read from the certificate of analysis for this batch. Veritura keeps the paperwork record and checks each result against the limit printed beside it. It does not test the medicine itself.
Buyer
Clean proof without internal leakage.
Customer-facing evidence is separated from internal notes, pricing, and supplier-approval language.
- The proof chain. Order, lot, COA, and review state, with the product and the reviewer named.
- Evidence rows. The COA, the supplier packet, and the memo, each with its status and the workflow it came from.
- The release state. Released proof, or review in progress. The customer link is generated on release.
- What is never in it. Internal pricing, private notes, supplier approval language, product-quality claims, or legal and medical conclusions.
Documentation evidence only. This does not approve a supplier, certify quality, confirm safety, provide medical guidance, or replace wet-lab testing.
Inspector
The full record, one tap away.
Everything an auditor or a pharmacist would want is kept in full behind one toggle, not removed from the page.
- Identity and record ID. Supplier, product, lot, order, COA reference, reviewer, methodology version, and the date the record was verified.
- A tamper-evident fingerprint. SHA-256 over the record's canonical fields in a fixed order, printed with the exact fields it covers. Change any field and the fingerprint changes.
- Verify it yourself. The browser recomputes the fingerprint locally from the visible record fields and compares it against the one on the record, so no trust in the page is required.
- Chain of evidence. The record's dated journey, each entry timestamped in UTC.
- The checks that ran. Required document-field completeness, source-chain reconciliation, duplicate and reused-document signal scan, order/lot/COA cross-match, and the customer-safe release gate.
- Documentation completeness at issue, in words, with how the lot cleared and on what date.
A paperwork-completeness read, never a product-quality or safety determination. The PDF copy exists to hand to a clinician; nothing pushes one at a patient.
Veritura is independent of the pharmacy that dispensed this medicine and of the supplier who made it. We read the paperwork behind a batch and keep the record. Documentation status only, never a quality, safety, or FDA-approval determination.
The verify path
One link, and anyone can resolve it.
Paste the verification link or record ID from a Veritura Evidence Passport or Verified Supplier record, and we will resolve the documentation read.
01
The link
Every released record resolves from its own verify address, and the lookup also takes a pasted record ID. A vial QR is scanned on a phone, so that is the surface the page is built for first.
02
What a Veritura record shows
An automated read of the submitted document by a party that does not sell the product. A tamper-evident fingerprint you can cross-check against the original certificate. Documentation completeness, source chain, and reuse signals.
03
Recompute the fingerprint yourself
The browser recomputes SHA-256 over the record's canonical fields, in that exact order, using its own WebCrypto, and compares the result against the fingerprint printed on the record.
04
When there is nothing to show
No released record for this link. The evidence record is not released for verification, or the link is incorrect. If you received it from a supplier, ask them for a current Veritura verification link.
Partner-branded pages
The attribution is the product, not a courtesy.
On a partner-branded host the partner's own mark leads, and the line under it reads "Independently verified by Veritura". It renders whenever a partner brand does, and there is no way to configure it off.
Boundary
Veritura is independent and reviews documentation only. A verified record is not a certification, an approval, or a claim that any product is safe, effective, legal, or FDA-approved.
After release
A released record keeps working.
Clean yesterday can become review-needed tomorrow.
Recall mode
Lot search becomes an action map. Search or select a lot and the ledger shows affected orders, buyers, COAs, supplier packets, and unresolved evidence gaps.
Continuous reverification
Evidence records are watched for stale COAs, new public-source posture, supplier changes, and repeat-reliance refresh windows.
Supplier notice watch
Public FDA recall and enforcement notices naming the supplier keep being read after release. A notice names the supplier, not necessarily the batch, and the record says exactly that instead of raising an alarm about someone's prescription.
Cross-account comparison
Your document evidence is compared across the Veritura account network, not just this workspace. Counts only: no other account's identity, supplier, files, lots, or customers are shown.
Audit trail
Every passport, supplier response, and release event stays traceable.
Evidence graph
Every released record strengthens supplier, lot, COA, reviewer, and dispute history.
What an enforcement record published months later does to a passport already issued.
The passport stays bound to its lot forever. That binding is the whole mechanism: without it a signal landing after release would have nothing to travel along.
- Engine
A flagged lot has passports minted from it.
Every passport bound to that lot is stamped with a post-release recall signal. Stamping is idempotent: the record stays in the FDA window for its whole duration, so a repeat sweep refreshes the existing signal in place rather than stacking duplicates.
The passport stays bound to its lot forever, which is what lets a later recall reach it at all.
Record state: Passport carries a post-release signal and a recall exposure line - Engine
Lots were flagged.
Each affected account is notified privately: a lot.recall_hit webhook and an email to the account owner, each seeing only its own lots. The fan-out is deduped so a given account, lot and recall fires once.
Record state: Account notified - Engine
The lot now carries a recall signal.
No new passport can mint or release from it, independent of every other state on the record.
Record state: 409 recall_exposure
A lot-number match against public FDA enforcement data is a documentation and enforcement signal, never a safety or approval determination. A lot number can be reused across firms, so the firm identity and the lot must be confirmed against the FDA record.
Why release it
A released record is what makes a fast notice possible.
A binder tells you a lot was received. It cannot tell you who is still holding a vial from it. Release is what turns the record into a reachable list.
The lot binding is permanent
A passport is bound to its lot at issue and the link is never rewritten. That binding is the path a recall published months later travels back along to every record already issued from that lot.
A patient can put themselves on the list
Scanning the seal on the vial opens the record, and a patient can claim it with an email address. The claim starts pending and only the emailed link activates it, so nobody is added to a list they did not ask to be on.
One button reaches everyone holding that lot
When a signal lands, a single action notifies every active claimant across every seal batch of that lot, deduplicated so one address gets one message, each deep-linked to the record it concerns.
It carries no patient identity
The record stores an email address, the saved serials, and the notice history for those serials. No name, no address, no health information, and no field for them. Deletion is self-serve.
A notice states what was published about a lot and links to the record. It is not a recall, not a clinical judgment, and not medical advice; the treatment question stays with the pharmacy or the prescriber who dispensed it.
What it costs
Usage is tied to released production evidence, not dashboard views.
A shareable, per-order proof of the documentation review behind a specific order. One link, one PDF. Commit to 500 or more per month and every Passport is $0.50.
- $3
- per released production Passport, pay as you go and separate from your plan
- $0.50
- per Passport at 500 or more per month, on a volume agreement
- Custom
- a committed rate for high-volume platforms
- $0
- Sandbox Evidence Passport records are free and non-billable, up to 25 records.
- First one
- Your first released production Evidence Passport is complimentary when that offer is enabled.
Sandbox records are free for testing. After production activation, the first released production Passport is complimentary; after that it is usage-based at $3 per order, separate from your plan. Commit to volume, 500 or more per month, and the rate drops to $0.50 per Passport on an agreement; high-volume platforms get a custom committed rate.
Usage trigger
A released production passport. Dashboard views and sandbox records do not create production usage events.
One release per order-lot-product
Production usage is controlled by client workspace rules, not dashboard views or repeated edits.
Sandbox stays labeled
Sandbox records are non-billable and clearly labeled. Production evidence records unlock only after a paid or signed client workspace.
The boundary
What this record does not establish.
On the shipping product the boundary renders inside the record, at the same size as the evidence above it. It is reproduced here the same way.
Boundary
Veritura does not test medicine, approve suppliers, recommend purchases, or make medical, legal, product-safety, or FDA-approval determinations. There is no paid or subjective placement: suppliers cannot pay for a better result or a better position, no listing fee, no subscription, and no pay-to-rank. Where results are ordered rather than filtered, the order is set by a published documentation-coverage grade, and that grade is never a recommendation, a preference, or a statement about any product.
Boundary
A COA check or Passport records whether the documents are complete and consistent. It is not a safety, quality, efficacy, legality, or FDA-approval claim.
Boundary
Documentation evidence only. This does not approve a supplier, certify quality, confirm safety, provide medical guidance, or replace wet-lab testing.
Boundary
This workspace can show internal notes, source gaps, and QA posture. The customer passport does not show internal pricing, private notes, supplier approval language, product-quality claims, or legal/medical conclusions.
Boundary
Documentation evidence, traceability, workflow control, and customer-safe proof only. No supplier approval, product-quality certification, legal advice, medical advice, or wet-lab replacement claims are generated by this layer.
Boundary
Evidence posture only. Not supplier approval, product-quality certification, legal advice, medical advice, or wet-lab replacement.
Produced under methodology v1.0, April 30, 2026.