Trust Center: Accountable, versioned, defensible. Every value cited to its line.
Named standards. Nothing overwritten.
Same evidence, same decision. Months later, kept as it was made.
Every release decision is signed and carries a copy of the policy it was made under, and nothing is overwritten. Veritura reads the paperwork and never tests the product.
Received, read, checked, decided, kept. Same order, every document.
Five steps, in the same order on every document, from the file arriving to the decision an inspector can replay.
Received as bytesFive ways in, one read, a fingerprint on every original.
A certificate arrives by email to the workspace's own address, through the supplier's door link, by upload, by a fetch by lot number or by API. It is identified by its bytes, never by its name or the type the browser claims.
- Five ways in, one read
- Formats checked by their bytes
- A SHA-256 fingerprint on every original
Read, and cited to the linePage and line, quoted word for word. Not stated is never guessed.
Every value the review relies on is cited to the page and line it was printed on, with that line quoted word for word. A field the certificate does not state is shown as not stated, never guessed.
- Page and line, quoted word for word
- Not stated is never guessed
- Unreadable is never clean
Checked against named standardsUp to 20 named checks in four groups, each naming what it rests on.
Up to twenty named checks sit behind every verdict, in four groups: the certificate itself, the substance, published limits and outside sources. Each names what it rests on, from 21 U.S.C. 353a and FDA's 503A lists to ICH, USP and FDA's own registries, searched at read.
- Up to 20 named checks in four groups
- Each names its statute, guideline or registry
- Could not run is never a pass
Decided by a named personEnforced on the server, on every path.
Nothing leaves a lot until a named person has reviewed it. The rule lives on the server and holds on every path: the dashboard, the API, order fulfilment, Vera's release plans, automatic release, Seals and shipments.
- Enforced on the server, on every path
- Name, time and meaning on every signature
- Bound to the hash, chained to the last
Kept, and replayableDecisions signed with the policy pinned. Every lookup kept.
Nothing a decision rested on is ever overwritten or deleted. A newer document is added beside the older one. A release decision is signed and carries a copy of the policy it was decided under, so the same evidence replays to the same decision.
- Decisions signed, with the policy pinned
- Every lookup kept with its receipt
- The methodology version on the record
Named standards. Not house opinions.
Every check names the statute, guideline or registry it rests on, and what it decides: up to 20 named checks, 6 FDA records, FDA's four 503A lists.
Whether the substance may be compounded, and whether its maker is named and registered.
21 U.S.C. 353a(b)(1)(A)The bulks list, the declined list, Category 1 and Category 2, each as FDA printed it.
As printed May 14, 2026A named person's sign-off, the laboratory named, and a reissue that references the original.
11.41 to 11.44, and 17.63Residual solvents against a 63-solvent table, with your dose's share of each daily exposure.
With USP <467>Cadmium, lead, arsenic and mercury against the limit for the route.
With USP <232>The endotoxin limit computed from your route and maximum hourly dose: K over M.
Bacterial endotoxinsA beyond-use date against USP's ceiling for its category and storage.
Beyond-use datesName, UNII, CAS, formula and weight against FDA's record; a conflict names both figures.
GSRSCited, named, signed. Never overwritten.
Mechanically and in the same order every time. Every check names its standard, every decision carries a name, and nothing is overwritten.
Every value the review relies on points back to the page and line it was printed on.
Every check names the statute, guideline or registry it rests on.
Every decision carries the name of the person who made it.
A correction is added beside what it corrects.
What the record holds, and what never reaches it.
Veritura is built around documents, business contacts and public records. It is not designed to hold a patient's identity, and the parts of the work that would need one stay with the pharmacy.
- Patients and prescribers' words are never kept on the server; an order is kept only as the reference you send
- A patient's email is kept only to send recall notices about their batch, until a year after its use-by date, with an opt-out in every email
- Other companies' people shown by name, never by email
Where the work stops. Printed on the record itself.
A record is defensible only if it claims no more than it checked. This is the line, on the record and here.
The full detail.
The standards the review rests on, how versions and corrections are kept, what the record holds, the services behind it and who answers for the method.
Every check, in the methodologyNamed standards, not house opinions What each one decides
- FD&C Act 503A
- Whether the substance may be compounded by one of the three routes, whether the original manufacturer is named and registered, and whether the certificate names the substance and the lot. 21 U.S.C. 353a(b)(1)(A)
- FDA's 503A lists
- The bulks list at 21 CFR 216.23(a), the substances FDA declined at 216.23(b), Category 1 and Category 2, each name as FDA printed it, with that date on the page. As printed May 14, 2026
- ICH Q7
- A sign-off by a named person for the quality unit, the testing laboratory named, the manufacturer's address, and a distributor's reissue that references the original certificate. 11.41 to 11.44, and 17.63
- ICH Q3C(R9)
- Residual solvents against a 63-solvent table with each solvent's permitted daily exposure; with your dose recorded, this substance's share of it, with the arithmetic shown. With USP <467>
- ICH Q3D(R2)
- Cadmium, lead, arsenic and mercury against the limit for the route; with your dose recorded, the share of the permitted daily exposure. With USP <232>
- USP <85>
- The endotoxin limit computed from the route and your maximum hourly dose, K over M, and compared with the limit the certificate prints. Bacterial endotoxins
- USP <1111>
- Total aerobic count and total yeasts and molds against the published acceptance criteria. With USP <61>
- USP <795> and <797>
- A preparation's beyond-use date against USP's ceiling for its category and storage, and against every ingredient's own expiry. Beyond-use dates
- FDA establishment registry
- The named manufacturer, searched at read. Registered to manufacture passes; registered only to relabel or repack does not pass as the maker.
- FDA substance registry
- The name, UNII, CAS number, formula and molecular weight on the certificate, compared with FDA's record. A conflict fails the verdict with both figures named. GSRS
- openFDA and FDA records
- The supplier, maker and laboratory matched at read, and lots on file re-matched against enforcement records on an hourly cycle. Enforcement, warning letters, import alerts, the 503B list
Each step, in full From arrival to replay
- Received as bytes
- PDF, PNG, JPEG, WebP and plain text are read; Word, Excel, SVG, HTML, empty files and anything over 8 MB are refused, and the refusal says why in words. Each original is kept as received with its SHA-256 fingerprint, and the same file sent twice is recognised and not filed twice. Paid plans keep every original; a free workspace keeps its first three.
- Read, and cited to the line
- The text as read opens beside the review, numbered exactly as the citations count it, and an absence is said in words. A document that cannot be read is reported as unreadable, never as clean: "Not verified. The document could not be read, so no check ran." The read is cached on the file's fingerprint, so the same bytes give the same reading twice.
- Checked against named standards
- The named standards include ICH Q7, ICH Q3C, ICH Q3D, USP <85> and USP <1111>. Anything short of a pass says what failed, why, what would pass and how to get there. A check that could not run is named with what it needs, and is never counted as passed.
- Decided by a named person
- The person records what they checked and what they relied on. A signature carries the printed name, the date and time, and a meaning from a fixed list. It is bound to the record's hash and chained to the workspace's earlier signatures, so an edited or removed signature breaks the chain and the page says so.
- Kept, and replayable
- The decision carries that policy's version. Every public lookup keeps its source, its query, its time and its result, and the methodology version is stamped on the record, so an inspector can replay how any decision was reached.
Versioning Nothing is overwritten. Everything is dated.
- Originals
- Kept as received with a SHA-256 fingerprint. A newer certificate is added beside the old one, never written over it.
- Signatures
- Bound to the record's hash and chained per workspace. A changed or removed signature breaks the chain, and the page says so.
- Release decisions
- Signed, with the policy and its version pinned inside, so the same evidence replays to the same decision.
- FDA's lists
- Shown with the date FDA printed them. The codified 503A lists are re-read from the eCFR every 24 hours, with the date the source gives.
- Practice records
- Every earlier version of a corrected record is kept, with who changed it, when and why.
- Custody
- Each event carries the hash of the one before it, so a line cannot be tidied afterwards without the break showing.
- The method
- The methodology version is stamped on the record. A material change takes a new version, noted publicly.
Corrections A correction is added, never swapped in
- A signature cannot clear a finding
- Only evidence moves it.
- A newer certificate
- Lets a named person set an older finding aside, with a reason. Both documents stay on file.
- A dismissed recall match stays dismissed
- An identical re-match never reopens it, and the signal and the dismissal both stay on the lot's history.
- Overruling Vera
- Is kept as the person's ruling, and an overrule needs a reason.
- A finding a firm answers
- On its published file stays on the file, marked retired, with its date. No one can pay to change what a file says.
- Supported observations
- Are never removed for being unfavourable.
- Asking for a correction
- Send the record or report ID, the observation at issue and the document that supports the change through the contact page.
Data handling What the record holds
- Patients and prescribers' words
- Are never kept on the server. The copy file lives in the pharmacy's browser and in a file it saves. An order is kept only as the reference the pharmacy sends, and a reference that looks like patient text is refused.
- An email used to deliver a Passport
- Is used to send the Passport, then kept as a recall contact for that batch: used only for recall or safety notices about it, never for marketing, never shared and never exported. It is deleted a year after the batch's use-by date, or at once when the patient opts out from the link in every email. A pharmacy's owner can switch patient email off; while it is off, an address is refused and nothing of it is kept.
- A patient who saves a vial
- Leaves an email, kept with their saved serials until they delete it.
- Closing or deleting a workspace
- The owner can close it: its records become read-only and stay exportable for six years, then it is deleted. Or the owner can delete it now, after an export is offered: every record, original and key of the workspace is erased, and only a receipt of the deletion stays. Each step is signed by name and logged.
- People at another company
- Are shown by name, job title and company, never by email address.
- Lookups stay private
- A clinic's or buyer's lookup of a pharmacy is private to its account; the pharmacy is not told. Across accounts, only counts are ever shared.
- Redact before you upload
- Patient identifiers, prescriptions and unrelated commercial terms do not belong in a supplier document. Redact them before submitting; nothing in a review needs them.
Security How the record is protected
- Encrypted, and scoped to your workspace
- Documents and records are encrypted in transit and open only inside the workspace they belong to. Database tables deny browser-side access by default, with row-level security.
- Kept with their fingerprint
- Originals sit in object storage with their SHA-256. If storage ever refuses a file, the record says so and asks you to keep the original; it never pretends a copy exists.
- Two-factor sign-in, encrypted secrets
- Authenticator secrets are encrypted with AES-256-GCM, and recovery codes are stored one-way and shown once. Sign-in with Google or Microsoft is available, and an enrolled authenticator is asked for after it too. Signing, holds, release and other quality decisions ask for the authenticator again when it has not been used recently. A workspace has the owner and up to 10 teammates.
- Production's security headers
- A strict content policy, HSTS, frame denial, nosniff, a strict referrer policy and a permissions policy, read from production's own headers.
Services behind the record What each one does
- Render
- Hosts the application.
- Supabase
- The database, and the object storage that keeps each original with its fingerprint.
- Resend
- Sends mail, and receives it at each workspace's own email-in address.
- WorkOS
- Sign-in with Google or Microsoft.
- Stripe
- Checkout. Veritura never stores card numbers or card security codes.
- OpenAI or Anthropic
- Reading scans and photos page by page, and the Second Reader, where they are switched on.
- Google Fonts
- Serves the typefaces on the public site and the sign-in page, so a visitor's browser requests them from Google.
Accountability Who answers for the method
- An accountable owner
- One methodology owner is accountable for every version of the method. Questions about it go through the contact page.
- A published version
- Methodology v1.1, dated October 19, 2026, is stamped on the record (v1.0, April 30, 2026, on records read before it; what changed is on the methodology page). A material change takes a new version and a visible note on this page.
- Professional liability
- $1M in professional liability (errors and omissions) coverage is in place for the documentation work. It does not turn any record into an approval or a regulatory sign-off.
- No paid position
- Veritura does not sell, route or rank pharmacies, takes nothing from orders, and has no ratings or badges to sell. A payment never awards a badge or changes an evidence result.
Veritura holds no USP-NF licence and never checks a certificate against a USP monograph's acceptance criteria. Where a monograph exists, it checks whether the certificate states that the lot meets it, and says so. Stated plainly: Veritura is not SOC 2 certified, not a HIPAA-covered system and not a validated GxP system. Its signatures are built to Part 11's signature elements. The first signature in each session asks for the signer's password; a signer with an authenticator is asked for it instead, when it has not been used recently. A person who signs in only with Google or Microsoft and has no authenticator is not asked again at signing.
Questions, answered plainly.
A person. Nothing leaves a lot until a named person has reviewed it, and the server enforces that on every path. A workspace that saves the Standard or Lenient policy can let Passports issue automatically, but only from a lot a person has already reviewed. A workspace that never saves a policy releases by hand, and Strict keeps every release with a person.
No. It reads the paperwork and checks it against the standards and FDA's public records. "Verified" is a statement about the documents, never about the substance in the vial.
The new evidence is added beside the old. A person can set an older finding aside with a reason once a newer document supports it, and both stay on file. A signature alone never clears a finding.
No. Where the Second Reader is switched on, its correction lands only if the line it quotes is found in the document, a field it contests holds the lot for a person, and it can never release, issue or notify. By default Vera drafts and a person sends; she never makes a first contact or a release on her own.
No. Strong identifiers such as a file's fingerprint or a report ID are compared across Veritura accounts, and each workspace sees only a count of the others involved. No other party's name, supplier, file, lot or order is ever shown.
Neither, and it says so. It is also not a validated GxP system. What is in place is listed on this page: encryption in transit, workspace scoping, row-level security, production security headers, fingerprinted originals and a hash-chained signature record.
Still have questions? Talk to a person.