What a COA is
A Certificate of Analysis, or COA, is a laboratory report for a tested sample. Depending on the product and test program, it may report identity, potency, cannabinoid profile, heavy metals, microbes, pesticides, residual solvents, or other analytes. It should identify the sample, laboratory, methods or panels, dates, and results clearly enough to understand what was actually tested.
“Third-party tested” is a claim; the report is the evidence a shopper can inspect. Showing the document does not prove every possible safety or quality attribute, and it does not convert a weak testing program into a strong one. Describe only the scope the report supports.
Why CBD and hemp processors ask for it
CBD and hemp merchants often face high-risk payment-processor underwriting. An underwriter may require third-party lab results for each batch, visible on the relevant product pages, before approving or continuing the account. Requirements vary by processor, sponsor bank, product, and jurisdiction, so obtain the current checklist directly from your provider.
This changes the job from “publish a trust PDF” to “maintain auditable evidence.” A year-old report on a generic testing page may fail because it cannot be matched to inventory being sold. Keep product, batch, report, and storefront references aligned, and retain the records your agreement requires.
Per-batch COAs beat one static PDF
The simplest Shopify setup uploads one PDF to Files and links it from a product description. That is adequate only while one report genuinely represents the inventory. As new lots arrive, the link can silently become stale. Shoppers holding a package cannot tell whether the report applies to them.
A per-batch system connects every COA to a product and lot or batch number. Show current reports on the product page and preserve appropriate history for prior buyers. Use unambiguous labels: product, batch, lab, test date, and report date. A separate Lab Results page can help discovery, but it should lead to product- and batch-specific records instead of becoming an unsorted document dump.
Connect package QR codes to the batch
A QR code on packaging should resolve to a durable lookup or record, not directly to a filename likely to change. The customer scans, enters or confirms the printed batch, and reaches the matching result. Test the code before packaging is printed, after deployment, and whenever routing changes.
Do not make the QR experience the only route. Product-page links support shoppers before purchase and people who cannot or do not want to scan. Use readable link text such as “View lab results for batch ABC123,” not “click here.”
Avoid fake or misleading COAs
Verify reports with the issuing laboratory when possible. Check that the laboratory identity and contact information are real; sample and batch identifiers match; dates are plausible; pages and signatures are complete; and the report has no inconsistent fonts, cropped sections, altered values, or missing qualifiers. Some laboratories provide a verification URL or report ID.
Never edit a laboratory PDF to improve its appearance or remove an inconvenient result. If a report is corrected, publish the laboratory-issued correction and preserve an audit trail. Explain whether the sample was submitted by the brand or collected independently; do not imply independent sampling when that did not happen.
Give every report an owner and lifecycle
Assign one role to receive laboratory reports, compare their identifiers with receiving records, approve publication, and retire superseded links. Define what happens when a result is incomplete, outside specification, corrected, or delayed. Store the original file and record when it became public; do not rely on a staff member's downloads folder.
Before releasing a batch for sale, test the product-page link and batch lookup from a signed-out phone. Confirm the PDF opens, text is readable, the batch printed on packaging matches, and an older buyer can still find the report that applied to their purchase. Repeat that check after theme or domain changes.
Publish and maintain the records
For a small catalog, Shopify Files and disciplined metafields may hold product, batch, and report links. As batches accumulate, a purpose-built workflow reduces stale links and mismatches. COA Vault publishes lab results on product pages and supports batch lookup without custom theme code.
COA Vault does not test products, authenticate documents, satisfy an underwriter automatically, or guarantee compliance. Your laboratory, quality team, processor, and qualified advisers remain the authorities. The app gives accurate records a clear storefront home.
Next step: View COA Vault on the Shopify App Store, or read how the app fits into the broader COA Vault product page.