Trust Center
Accountable, versioned, defensible.
This page is how the work is governed and where its limits are. Veritura checks paperwork. It never tests the product.
Veritura surfaces evidence signals that resolve against the policy each customer sets. Anything marked for review stays the customer's to decide. Veritura never certifies product quality, approves a supplier, or makes safety, legal, or FDA-approval claims.
- Published methodology
- v1.0, dated April 30, 2026
- Professional liability
- $1M E&O coverage in place
- Evidence trail
- SHA-256 hash and evidence ID on every reviewed document
- Independence
- Veritura does not sell, source, or distribute product
The record
Six standing facts.
Published methodology v1.0
Every reviewed output stamps the methodology version (v1.0 . 2026-04-30). Material changes require a new version and a visible record on this page.
SHA-256 evidence trail
Every reviewed document is hashed and assigned an evidence ID, preserved in the report so the file can be reconstructed at inspection time.
Human review, labeled precisely
AI assists first-pass extraction and drafting. A human reviews the final language on delivered diligence memos. Automated checks and Passports claim no human sign-off.
$1M professional liability (E&O) coverage in place
Professional liability / errors-and-omissions coverage supports the documentation-diligence work. It does not convert any report into approval, safety coverage, legal advice, or regulatory sign-off.
Protected and access-scoped
Documents and evidence records are encrypted in transit, access-scoped to your workspace, and handled through provider-backed storage controls when production storage is configured. Practice and sample packets are isolated from billing and delivery.
Correction policy
If evidence changes, the record is corrected transparently, with the basis for the change preserved. Findings are tied to evidence, not opinion.
Methodology
How a record is built.
A mechanical, repeatable process, so two reviewers reach the same record and an inspector can follow it.
Executive verdict
The record opens with the posture a human can act on, not a hidden conclusion.
Evidence map
Material observations point back to source files, fields, hashes, or explicit limitations.
Reconciliation, four buckets
Matches, mismatches, missing documentation, and could-not-verify. No subjective or paid ranking, no vendor scoring, no certification of product quality. Published Verified Supplier profiles carry an objective grade of the documentation evidence only.
Completeness, field by field
COA, lot, lab, method, purity, MS and sequence evidence, sterility, endotoxin, strength, address, and disclaimer language. Presence or absence recorded mechanically, and a field the document does not state is recorded as not stated on the document rather than inferred.
Forensics and reuse
Cross-document forensics surface reused certificates and duplicate-report signals across the entire index. The specific detection signals are deliberately unpublished: publishing them would teach document fraud how to evade them.
Source checks
FDA, openFDA, import-alert, NDC, and lab-verify lanes preserve the search, source URL, capture date, and reviewer context.
Supplier qualification file
The six-element file is built with honest tiers. Each item is labeled Veritura evaluated or Operator attested, with a living current, due, or overdue status on every dated document.
Risk boundary
Every output excludes product approval, safety, legal, medical, or purchase language.
Next action
The client sees the supplier ask, hold, review, or release step tied to the evidence. At receiving that ask is drafted for them, composed from the specific gaps the gates found.
Human QA
The output becomes a reliance hold, a supplier question, an evidence memo, or an Evidence Passport. Never supplier approval or product certification.
- methodology
- v1.0 . 2026-04-30
- reconciliation
- 4 buckets
- completeness
- field-by-field
- evidence_id
- E1 . SHA-256 recorded
- forensics
- reuse / producer signals
- source_lanes
- openFDA . NDC . lab
- qa
- release-gated
- determination
- none, signals only
boundary
AI may assist extraction and drafting. Delivered written diligence memos receive human QA. Self-serve checks, ClearGate decisions, and Passports are automated unless the record explicitly says otherwise, and no human sign-off is claimed on them.
Source lanes
Five lanes, each one recorded.
Every lane preserves the search, the source URL, the capture date, and the reviewer context.
The issuing lab is resolved against a verify-portal registry with a ready-to-send confirmation email, and only a recorded lab reply flips a document to source-confirmed.
Published scope
What is checked, and the public sources it is checked against, are published. The detection heuristics themselves are not, because publishing them would help fraudulent documents evade them and because they change faster than any page.
The checks
Every document is checked against four things.
Each document is reconciled against the lab that issued it, the standard it has to meet, the file's own internals, and every other document we have seen. Each lane returns one of three states with its reason, ran, not applicable, or could not verify, and no lane is allowed to disappear. Findings are signals for human review, never approval or safety claims.
Checked against the lab
Checked against the standard
Checked against the file itself
Checked against the network
How each lane runs, and the full published check catalog, is on the evidence engine.
Public sources
openFDA enforcement and recall records
Lots and firms are matched against open enforcement and recall data in real time.
FDA registration snapshot
Manufacturer identity is checked against a dated registration snapshot, and unmatched names are surfaced for review.
503B registered-facility list
A dated capture of the FDA outsourcing-facility list, shown with both its source date and its capture date.
503B snapshot: FDA's list current as of June 23, 2026, captured June 30, 2026
Not found in the snapshot never means not registered. It means the name did not match the captured list.
Vocabulary
Three axes. Never mixed.
A result is a documentation posture of Clear, Review, or Hold on the document set. A ClearGate decision of Allow, Review, or Hold is a separate axis, resolving one order against the policy you configure. Both describe the paperwork, not the medicine.
Evidence posture
ClearGate
A ClearGate decision always means the documentation meets your policy. It never means Veritura approves the supplier. Customer-facing phrasing: Meets your policy, Needs review, Does not meet policy.
Evidence origin
limitation
Absence of a public match is not proof of absence. A missing document is not a failed test. A similarity indicator is not a fraud determination.
Evidence Passport
Semaglutide (base) API
Evidence posture
Evidence posture: ClearThe document set met the configured policy. It describes the paperwork, not the medicine.
Certificate of analysis
Source-confirmedThe issuing laboratory confirmed issuance through the recorded verification route.
- Order
- PO-DEMO-0413
- Lot
- LOT-7741-A
- Supplier
- Aurora Pharma Supply
- Quantity
- 250 g
- Received
- July 22, 2026
- Released
- July 23, 2026
- Passport issued
- July 23, 2026
- Methodology
- v1.0 · April 30, 2026
Documents on file
6
- Source-confirmed
Certificate of analysis
COA-7741-A.pdf · Issuing laboratory confirmed issuance through the recorded route
- Veritura evaluated
Certificate of conformance
CoC-7741.pdf · Required identity, lot, and date fields present
- Veritura evaluated
Safety data sheet
SDS-SEMA-04.pdf · Current revision on file
- Operator attested
GMP certificate
GMP-AUR-2026.pdf · Supplied by the operator
- Operator attested
Receiving inspection
Recorded in workspace · Container and label checked at receipt
- Veritura evaluated
Shipment label
LBL-7741-A.jpg · Lot identifier matches the certificate of analysis
What this record does not establish
- Documentation diligence only. No product was tested and no supplier was approved.
- Absence of a public-source match is not proof of absence.
- Produced under methodology v1.0, April 30, 2026.
Governed by
The methodology has a named owner.
- Joey Soto, founder
- Accountable for the methodology
- PharmD and sterile-compounding advisors
- Input on the methodology
- Regulatory affairs and 503B quality advisors
- Input on the methodology
Final operational decisions stay with the customer.
Advisors appear as roles. A named advisor quote may only be published if that person actually gave it in writing.
Operating boundary
What Veritura does not do.
Veritura does not
Rank vendors by preference, payment, or judgment, recommend purchases, test physical material, certify products, provide medical, legal, or regulatory advice, determine legality, or confirm FDA approval, clearance, or registration.
Veritura does
Document what is present, conflicting, missing, changed, or not verified in reviewed materials, with cited evidence, hashes, limits, and the next supplier question, for a human to decide.
boundary
Veritura does not test medicine, approve suppliers, recommend purchases, or make medical, legal, product-safety, or FDA-approval determinations. There is no paid or subjective placement: suppliers cannot pay for a better result or a better position, no listing fee, no subscription, and no pay-to-rank. Where results are ordered rather than filtered, the order is set by a published documentation-coverage grade, and that grade is never a recommendation, a preference, or a statement about any product.
Security and data handling
Supplier diligence should collect less data, not more.
Veritura is built around document evidence, business contact information, source records, and report boundaries. It is not designed to collect patient information, intended use, clinical outcomes, or medical histories.
- Posture
- Data minimization first
- Patient data
- Not requested
- File record
- Name, size, metadata, SHA-256 hash
- E&O coverage
- $1M professional liability (E&O) coverage in place
- Contact
- Joey@veritura.co
Data minimization
Intake asks for business contact details, supplier identifiers, document context, and decision context. It does not ask what a patient is taking, why a product might be used, or what outcomes are expected.
File identity preservation
For browser-submitted files, Veritura records name, type, size, last-modified time, and a browser-side SHA-256 hash, so the submitted document identity is preserved.
Provider separation
Structured records go through Supabase, email confirmations through Resend, and checkout through Stripe. Veritura does not store card numbers or card security codes.
Access boundary
Administrative surfaces are separate from public pages and require administrator authorization. Public static access is restricted to an explicit server allowlist.
Report boundary
Reports are documentation diligence records only. They do not approve suppliers, verify product quality, certify purity, determine legality, or replace supplier qualification and wet-lab testing.
Correction route
Users, suppliers, vendors, and labs can submit factual corrections or supplemental evidence through the correction process or by contacting Joey@veritura.co.
Partner referral data posture.
Referral posture
Client submits directly.
Partners can send clients to Veritura without collecting the packet themselves.
Patient data
Not requested.
The intake is designed for supplier documents, business context, and redacted source material.
AI triage
Paid and bounded.
AI-assisted review is usage-capped, logged, and positioned as a draft layer before final delivery.
Output
Document memo only.
No supplier approval, product certification, clinical guidance, or purchase facilitation.
Current controls in place before customer outreach.
| Control | Posture |
|---|---|
| Database access | Supabase row-level security enabled; public tables deny browser-side read, insert, update, and delete by default. |
| Server boundary | Service-role access is server-side only. The browser workflow submits through API routes rather than direct unrestricted database access. |
| Traceability gate | Production Evidence Passports are locked. Sandbox records are non-billable. Production order release requires a paid or signed workspace and creates one deduped usage event per order, lot, and product identity. |
| Admin session | Admin cookies store a random session token. The server stores only a SHA-256 hash of that token for lookup. |
| Admin writes | Admin login is rate-limited and admin mutation routes require same-origin requests. |
| Browser hardening | Content Security Policy, frame denial, HTTPS HSTS, nosniff, permissions policy, and same-origin resource policy are set by the server. |
| Payment data | Stripe-hosted checkout. Veritura does not store card numbers, card security codes, or bank credentials. |
| Insurance posture | $1M professional liability (E&O) coverage in place. Professional liability coverage supports documentation-diligence services. It does not certify suppliers, product quality, legality, or safety. |
Handling matrix
What belongs in Veritura and what should stay out.
Good input
- Supplier COAPacket evidence tied to the supplier decision.
- Supplier quote or product pageUsed to compare claims, fields, and public documentation.
- Lab reference or QR evidenceUsed to record whether lab-verification material is present.
Do not submit
- Patient identifiersNames, dates of birth, medical record numbers, prescriptions, and health histories are outside scope.
- Clinical use detailsIntended use, dosing, treatment goals, outcomes, and adverse events are outside scope.
- Unrelated confidential termsRedact nonessential pricing, banking, and unrelated commercial terms.
limitation
Users should redact patient data, protected health information, patient identifiers, prescription records, nonessential pricing terms, and unrelated commercial information before submitting materials for review.
Data boundaries
What is recorded, and what has no field at all.
Data minimization first. Patient data is not requested, and where Veritura declines to collect something, no field for it exists.
Recorded
- Document identityFor browser-submitted files: file name, file type, file size, last-modified timestamp, and a browser-side SHA-256 hash, so the submitted document identity can be preserved.
- Report dataSubmitted URLs, uploaded document metadata, extracted fields, hashes, evidence records, and account details, used to provide saved reports and monitoring.
- Source contextEach FDA, openFDA, import-alert, NDC, and lab-verify lane preserves the search, the source URL, the capture date, and the reviewer context.
- Patient vial claimsWhen a patient saves a vial from its scan page, the email address, the saved vial serials, and the notice history for those serials. Nothing else.
Never collected
- Intended useVeritura does not ask what a user intends to do with any product, what conditions they have, what they are taking, or what outcomes they seek. No field for that information exists.
- Patient identityNo name, no address, and no health information is stored against a saved vial, and no field for them exists.
- Clinical detailIntended use, dosing, treatment goals, outcomes, and adverse events are outside scope, as are patient identifiers, prescriptions, and health histories.
- Card and bank credentialsCheckout is Stripe-hosted. Veritura does not store card numbers, card security codes, or bank credentials.
Deletion
Every vial claim is patient-initiated from a printed seal and confirmed by email, and deletion is self-serve: the Delete my space control removes the account and stops all notices.
Report limitations
Reports document evidence. They do not certify products.
Reports are not safety assessments, quality assessments, legal determinations, or purchase recommendations. There is no paid or subjective placement; where results are ordered, they are ordered by the disclosed documentation-coverage grade published above.
limitation
Not a safety assessment. Veritura does not determine whether any product is safe, sterile, effective, pure, legal, or appropriate for any use.
limitation
Not product testing. Reports are based on submitted documents, public pages, metadata, and snapshots. Veritura does not test physical material.
limitation
Authenticity limits. A report may identify metadata, repeated file signals, links, and inconsistencies. It cannot prove document provenance unless an issuing lab or source independently confirms it.
limitation
No purchase recommendation. Reports do not recommend, endorse, discourage, rank, or facilitate purchases from any vendor.
Current posture
Controlled and documented
The current standard documents operating controls, boundaries, and buyer-visible safeguards.
Privacy
Built around data minimization.
We collect what is needed to provide the diligence record, and nothing about who you are or what you intend to do.
boundary
No intended-use collection. Veritura does not ask what a user intends to do with any product, what conditions they have, what they are taking, or what outcomes they seek.
boundary
Report data. Submitted URLs, uploaded document metadata, extracted fields, hashes, evidence records, and account details may be used to provide saved reports and monitoring.
boundary
Documents. Uploaded documents are processed to extract documentation signals. Users should avoid submitting private health information or unnecessary personal data.
boundary
Patient vial records. When a patient saves a vial from its scan page, Veritura stores the email address, the saved vial serials, and the notice history for those serials, and nothing else. It never stores a name, an address, or any health information, and no field for them exists. Every claim is patient-initiated from a printed seal and confirmed by email, and deletion is self-serve: the Delete my space control removes the account and stops all notices.
boundary
Contact. Privacy requests and correction requests should reference the relevant report ID, account email, or submitted source, and can be sent to Joey@veritura.co.
boundary
Boundary. Veritura is document diligence only. It does not provide medical, legal, pharmaceutical, or purchase advice, and does not make safety, quality, or FDA-approval claims.
Terms
Documentation intelligence, not regulated advice.
boundary
Service scope. Veritura evaluates documents, public page text, metadata, source references, and historical changes using fixed documentation checks.
boundary
No professional advice. Reports are not medical, legal, pharmaceutical, regulatory, laboratory, or purchasing advice, and are not supplier approval or product certification.
boundary
User responsibility. Users are responsible for the materials they submit and for independently evaluating any decisions outside the report scope.
boundary
Corrections. Veritura may update, annotate, or preserve reports based on correction requests, supplemental evidence, methodology changes, or operational requirements.
boundary
Service contact. Questions about accounts, reports, corrections, or access can be sent to Joey@veritura.co.
Acceptable use
Keep submissions factual, document-based, and non-medical.
Keep the review focused on supplier evidence, and keep medical, legal, and patient details outside the workflow.
boundary
Do not submit health details. Do not submit personal medical histories, outcomes, dosing information, or intended-use details.
boundary
No false or misleading submissions. Do not upload altered documents, impersonate vendors or labs, or submit correction requests without evidence.
boundary
No purchasing facilitation. Do not use Veritura to coordinate purchases, sales, shipping, sourcing, or transactions involving regulated or unapproved products.
boundary
No abuse. Do not scrape excessively, attack the service, harass vendors or users, or use generated reports out of context.
The redaction rule that goes with these rules is published above. Security and data handling
Corrections
Reports change when the evidence supports a change.
Nothing is silently rewritten, and nothing supported is removed because it is unwelcome.
boundary
Who can submit. Users, vendors, labs, or other relevant parties may submit factual corrections, supplemental documents, or responses tied to a report ID.
boundary
What we review. Correction requests are reviewed against the underlying source material and the methodology version used for the report.
boundary
What we do not remove. Veritura does not remove supported observations because they are unfavorable. Reports are corrected when a factual error or missing source is demonstrated.
boundary
Vendor responses. Where appropriate, a response or supplemental document may be attached to a report without changing the original observation.
boundary
Correction contact. Correction requests should include the report ID, the specific observation at issue, and the document or source that supports the correction. Send requests to Joey@veritura.co.
A correction request includes
- The report ID
- The specific observation at issue
- The document or source that supports the correction
Send requests to Joey@veritura.co.
What a correction cannot rewrite
Evidence-backed corrections can update factual records without rewriting the methodology trail.
A check you can put in front of a board or an inspector.
Follow one lot end to end, from the read to the record you hand someone, or talk to us about covering your supplier base.