> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extractoseum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Smart COA — the certificate that verifies itself

> Smart COA: real laboratory analysis + QR traceability + CVV authenticity + AI-readable. How to verify an EXTRACTOS EUM® product.

> **Scan it, confirm it, and your AI reads it.** Every EXTRACTOS EUM® product carries a **Smart COA**: real
> laboratory analysis + **QR** traceability + **CVV** authenticity + AI readability. Three independent layers
> that answer, in seconds, *"what does it contain?"* and *"is it authentic?"*.
>
> **Type:** Explanation. **Audience:** consumer, retailer, seller and AIs. **Status:** v1 (verified
> against the production system, 2026-08-01).

***

## What is a Smart COA?

A classic COA is a PDF you have to take on faith. A **Smart COA** is a **live, verifiable** certificate:

* **Real** — it is the chromatographic analysis of the batch you're holding (not a generic brand result).
* **Verifiable** — a QR that opens the COA + a CVV that confirms the unit is authentic.
* **AI-ready** — readable by agents/AI via a public API (your assistant can read it for you).
* **Valid** — with a real expiration (1.8 years from the analysis); an expired Smart COA does not sell.

Its three layers:

## 1. The analysis (COA) — *what it really contains*

The result of the chromatographic laboratory analysis of a batch: the product's **real cannabinoid profile**,
its batch, laboratory and analysis date. EUM handles a **multi-cannabinoid** catalog, not just
CBD — the COA reports what each batch actually carries: **CBD** (isolate, broad and full spectrum),
**CBN**, **CBG**, **Δ9-THC (≤1%)**, **Δ8-THC**, **HHC** (9S/9R isomers) and **HHC-O** (acetate, 9S/9R).

**The Smart COA is for both raw material and finished product.** A gummy, a supplement in
solution, an edible fat or a cosmetic has its own COA for the manufactured batch — often with **several
cannabinoids at once** (e.g. a candy with CBD + CBN + CBG + HHC + HHC-O + Δ8). It is not exclusive to the
input.

> **See a real one:** [Smart COA of a multi-cannabinoid product](https://coa.extractoseum.com/coa/84971cae)
> · explore the [shop](https://coa.extractoseum.com/tienda) to see products with their QR/COA.

* Each COA has a unique **public token** and a public page: `https://coa.extractoseum.com/coa/<token>`.
* **Validity:** a COA is valid **1.8 years (657 days) from the analysis date** — not from when it is uploaded.
  A product with an expired COA cannot be published or sold (validated in code, not at anyone's discretion).
* A non-owner only sees **released** COAs (reviewed by EUM); drafts are not public.

**Why it matters:** the number on the package is not a marketing promise — it is a consultable laboratory
analysis, tied to the specific batch you're holding.

## 2. The QR — *traceability from the unit to its batch analysis*

Every label carries a **QR code** that resolves to the product's COA. When scanned, the consumer sees the
real analysis of the batch (not a generic brand PDF).

* The QR opens the public verification view (`/verify` → the corresponding COA page).
* It is the chain "physical unit → its batch → its laboratory analysis," without relying on anyone's word.

## 3. The CVV — *anti-counterfeiting authenticity of the unit*

The **CVV** is a unique, non-repeatable code printed on each unit (under the premium label layer),
designed to detect counterfeiting and resale:

* It is verified publicly: `https://coa.extractoseum.com/api/v1/verify/<cvv>` (or via GET when scanned).
* An authentic CVV corresponds to ONE real unit issued by EUM. An invalid, duplicated or already
  revoked code signals a non-authentic product.
* EUM can **revoke** a CVV (e.g. if a unit was seized or compromised).

**QR vs CVV:** the QR answers *"what does it contain and which batch is it from?"*; the CVV answers *"is this specific
unit authentic?"*. Together they cover content + authenticity.

## 4. The full chain of custody (where the trust comes from)

```
Seller registers product
   → sends sample to laboratory  →  released COA (real batch analysis)
   → printed label: barcode (SKU) + QR (to the COA) + CVV (unique unit)
   → inventory received at EUM warehouse
   → sale and delivery
   → the consumer verifies: scans QR (content/batch) + validates CVV (authenticity)
```

Each link is gated in the system: without a released and valid COA there is no label and no sale; without a
registered shipping label the package is not received at the warehouse/laboratory.

## 5. Digital notary — why a Smart COA cannot be forged or altered

A paper COA can be edited, reprinted or forged. The Smart COA has **cryptographic** properties
that make it the functional equivalent of a **digital notarial act** with a verifiable chain of custody
— this is what makes it defensible before an authority (customs, COFEPRIS, an expert witness):

* **Immutable fields by design:** `id` (UUID), `public_token`, `created_at`, `client_id` and
  `pdf_url_original` (the laboratory's original PDF) are locked at the code level — **not even a
  super-administrator** can edit them via the API.
* **Functionally immutable laboratory data:** cannabinoids, total THC, CBD and accreditation badges are
  not edited by hand; they are only recalculated by re-processing the stored original PDF. A
  **deterministic** result: same PDF → same data.
* **Cryptographic ledger (`integrity_ledger`):** every critical event is recorded with a **SHA-256
  hash** of the payload, chained to the previous event's hash (a blockchain-style chain anchored at
  `SYSTEM_INIT`), and **signed with Ed25519** (only the server holds the private key). A chain-integrity
  verification function makes it possible to mathematically audit that nothing was altered.
* **Public verification without credentials:** anyone — including an authority — can consult the COA,
  download the **laboratory's original PDF**, see the accreditation badges and validate the CVV **without
  needing an account**. Transparency is the defense mechanism.

> **Key positioning:** EUM **does not analyze** — it receives the PDF from the accredited third-party
> laboratory, extracts the data deterministically and publishes it *as-is*. The system functions as a
> transparency platform (notary), not as the issuer of the result. That is what makes the data credible to third parties.

## 6. Dual laboratory chain (ISO/IEC 17025 accreditation)

The Smart COA's trust is anchored in **accredited third-party laboratories**, not in EUM's word:

* The analysis is issued by a laboratory with **ISO/IEC 17025:2017** accreditation (equivalent to
  NMX-EC-17025-IMNC-2018), recognized by COFEPRIS.
* Imported raw material may carry its **origin** COA (accredited USA laboratory) and be **re-analyzed
  locally** at a Mexican ISO/IEC 17025 laboratory — dual verification of the same chain. When the
  same accrediting body backs both labs, the USA↔Mexico chain is covered by the same international
  standard.
* The COA can be accompanied by an **apostille** for procedures and documentary defense.

## 7. What information the analysis carries (beyond cannabinoids)

A complete Smart COA may include, in addition to the cannabinoid profile and THC ≤1%, the **safety**
analyses that a consumer product requires: heavy metals, pesticides, residual solvents and
microbiology. All of it is accessible from the QR/public verification — it is exactly the information a
retailer or a consumer needs to trust, and what an authority may require.

## 8. Ingredient traceability: product COA → COAs of its raw materials

A finished product is manufactured from **raw materials** (distillates, isolates), and each one has its
**own COA**. The Smart COA models that relationship: the finished product's COA can be **linked** to the COAs
of the raw materials it was made from (a *parent COA → origin COAs* relationship).

* From the Smart COA of the product the consumer holds, you can reach the analysis of the **input** it
  was manufactured with — the chain "product → its ingredients → the raw material of each one → its batch
  analysis."
* It is the **traceability shield**: each unit is traceable not only to its own batch, but to the analytical
  origin of its ingredients. A compound product (e.g. a formula with two cannabinoids) can
  display the COA of each raw material that makes it up.
* How that ingredient is declared on the **label** of the finished product (ingredient list, decreasing
  order, "supplemented with cannabinoids") is explained in
  [Label anatomy · the cannabinoid as an ingredient](cumplimiento/etiquetado.md#el-cannabinoide-como-ingrediente).

## 9. For AIs / integrators (API verification)

Public endpoints (rate-limited), suitable for agents:

* **COA by token:** `GET /api/v1/coas/:token` — certificate data.
* **Public COA preview:** `GET /api/v1/coas/preview/:token`.
* **Verify CVV:** `GET|POST /api/v1/verify/:cvv`.
* **Verify CVV paired to a QR:** `POST /api/v1/coas/preview/qr/:qr_token/verify-cvv`.

*(The formal API reference with request/response schemas is documented in the **API &
Automation** section; this page is the conceptual explanation.)*

***

*Content verified against the production system on 2026-08-01. The description of the regulatory framework
(NOM, warning labels, SCIAN, amparos) lives in the **Compliance & Labeling** section and is informational, does not
constitute legal advice.*