COA and Batch Data Display for Supplement Stores: The Data Model Behind It | Digital Heroes
Treat a certificate of analysis as a record, not a PDF. Digital Heroes gives every batch its own entry: the lot code exactly as printed, the variant, manufacture and expiry dates, a status, and each test document with its laboratory and issue date. Shopify has no native lot dimension, so the layer is metaobjects. Give every lot a permanent URL, keep superseded lots live, and capture the lot at fulfilment.
You have an email asking for the certificate of analysis for lot 24B117. Your site has a COA page. It holds eleven files, none named after a lot, two for a product you discontinued last spring, and the document that customer wants was replaced three weeks ago when the next batch landed. So you open a shared drive, find something close, and send it as an attachment.
That is not a content problem. It is a data modelling problem somebody solved with a file uploader.
The person asking is not browsing your quality page. They are holding a physical object with a code printed on it, and they want the record for that code, from that laboratory, on that date. Every decision below follows from that. Digital Heroes builds ecommerce stores for supplement, nutraceutical and research-use brands, which plenty of agencies decline.
The short version
- Model the lot, not the file. A batch is a record with a code, a variant, a fill date, an expiry, a status and one or more documents attached.
- One lot usually has several documents. Identity, heavy metals and microbiology come back from different laboratories on different dates, so a document is its own entity.
- Store the lot code exactly as printed, plus a normalised copy for lookup. Buyers type the letter O for zero and drop leading zeros.
- Give every lot a permanent URL on a domain you own. Never delete a superseded lot, never overwrite a published file, never print a QR code aimed at an app vendor's domain.
- A certificate link that returns a 404 is worse than no link at all. Absence reads as an omission. A dead link reads as a removal.
- Capture the lot on the order at fulfilment, or you cannot say which batch a named customer received.
- Digital Heroes engagements here start at 1,000 US dollars and rise with catalogue size, integrations and migration scope.
A certificate of analysis is a record, not a file
Draw the entities before anyone opens a theme editor. There are four. Product and variant you have. A lot belongs to a variant, not a product, because the 60 count and the 120 count of one formula are coded separately. A test document belongs to a lot, and there is normally more than one.
That last point is where most builds break. One batch commonly produces an identity and potency panel from one laboratory, heavy metals from a second and microbiology from a third, each with its own report number and issue date. Modelled as a single file field, the second report silently overwrites the first, and nobody notices until a customer asks for the one that is gone.
The fields nobody remembers until an audit
- The lot code as printed, and a normalised version for matching. Two fields, not one.
- The variant it was filled into, the fill date, the best-by or expiry date.
- A status from a fixed list: current, superseded, withdrawn. Free text becomes eleven spellings within a year.
- A pointer to the lot that replaced it, so a superseded page can send the reader onward.
- Per document: laboratory name, accreditation reference, sample received date, report issue date, report number, the file, and a hash of the file.
Carry the laboratory as data, not a logo baked into a PDF. Testing laboratories are assessed against ISO/IEC 17025, and a reader checking that needs the name and reference as copyable text. If your labels carry a GS1-128 barcode, the batch sits in application identifier (10) and the expiry in (17), so the lookup can take a scan.
Shopify has no native lot dimension: inventory is tracked per variant per location and stops there. So the lot layer is metaobjects you define, an app that rents you its schema, or a service of your own. That choice is made in week one and it is the most consequential one.
Superseded lots, old links and the 404 that costs you the sale
Printed inventory outlives websites. A label printed this month can sit in a distributor's warehouse for two years and reach a buyer long after you have changed theme, app and platform. Any URL you print is permanent whether you meant it or not.
So the rules are narrow. Decide the URL shape once, as /lot/{code} on your own domain. Keep superseded lots live, showing status plainly and linking to the current batch. Never overwrite a published document in place; a corrected report gets a new object while the old one stays reachable. A withdrawn lot still resolves and says so, in wording your regulatory counsel approves.
The failure worth naming outright is the dead link. A buyer who scans a code and lands on a 404 does not email you. They put the bottle down and do not reorder, and you never see it in any dashboard. A store with no COA programme reads as one that has not got to it. A broken one reads as a document that was taken down.
The quieter version: batch apps mint COA URLs on the vendor's domain and brands print those. When the app is deprecated, every label in distribution points at somebody else's server.
Where the files live, and who is allowed to read them
A platform file store is convenient and it is also a lock: every document sits at a URL the platform controls, so a replatform moves every link you have printed. Object storage with versioning and write-once retention, S3 Object Lock for instance, gives you a file that cannot be quietly replaced and an origin you can swap without touching a printed URL. Publish a SHA-256 hash beside it.
Scrub the PDFs on ingest. Laboratory reports routinely carry the internal filename, the requesting employee's name and sometimes another client's reference in the document properties. Flatten and strip. Handle the other habit of laboratory PDFs at the same time, which is that many are scans with no text layer: render an HTML table of the result rows beside the file, and the page becomes searchable and screen-readable while the PDF stays the record.
Access control is a policy decision for your counsel. Whichever level you pick, model it as a field and make the gated route return a real page with a prompt, never a 404.
Research-use positioning, age gates and disclaimers are fields, not copy
Research-use-only positioning, age gating and disclaimer blocks get typed into product descriptions because that is the fastest place to put them. Six months later they have drifted. Two products carry last year's wording, one carries none, and the version reaching a marketplace feed differs again.
Make it a field. A product-level attribute with a controlled vocabulary drives the template: which badge renders, which disclaimer appears, which shipping methods are offered, whether checkout asks for an attestation, whether the item enters a feed. Written once, read everywhere, changed in one place when your counsel changes their advice.
Digital Heroes builds the site and does not give legal or regulatory advice. What your labelling must say, which claims you may make and which jurisdictions you may ship to belongs with a qualified regulatory attorney, and the build implements that decision rather than guessing at it. What a development team adds is that the decision is enforced by the system instead of by whoever last edited a description.
What breaks at three hundred lots
The design that works for twelve lots stops working somewhere in the low hundreds, in three places.
The index. Three hundred lot pages are three hundred pages of near-identical chrome around a table. Set them to noindex, keep them out of the sitemap, keep one lookup page indexable. Crawl budget spent on batch documents is not spent on products.
The admin. In our own projects, manual upload stops being viable at around twenty new lots a month. That is the point to move to a watched mailbox that parses incoming reports, or an interface to the laboratory or enterprise resource planning system. Buyers also mistype, so normalise case and spacing.
The order join. This is the one that pays for the project. Capture the lot at fulfilment, as a line item property written by the warehouse system or a warehouse record joined back to the order. Do that and a withdrawal is a query returning the exact buyers affected. Skip it and the same event becomes an email to your whole list. If you already run lot-numbered inventory in NetSuite, Cin7 or Katana, that is the source of truth and the store should read from it rather than keep a second set of records that will disagree.
The decisions you actually have to make
| Decision | Realistic options | Trade-off | Cost of getting it wrong |
|---|---|---|---|
| Where the lot record lives | Metaobjects, a batch app, or your own service on the ERP | An app is fastest and rents you its schema, your own service survives a replatform | Rebuilding the lot layer at replatform |
| The COA URL | /lot/{code} on your domain, a product anchor, or an app vendor URL | Only the first survives a change of app or platform | Dead QR codes on stock you cannot recall |
| Superseded lots | Delete, keep serving, or redirect to the current lot | Deleting breaks printed codes, redirecting hides what was asked for | Support load and unmeasured trust loss |
| Documents per lot | One file field, or a repeatable list | A single field means each upload replaces the last | Losing microbiology when heavy metals lands |
| File storage | Platform files, or object storage with versioning and object lock | Simpler, against immutable and portable | Re-matching a whole archive at migration |
| How lots get in | Manual upload, a parsed mailbox, or a lab interface | Manual works below roughly twenty lots a month | Site documents no longer matching what ships |
| Lot on the order | Not captured, a line item property, or a warehouse record joined to the order | Only the last two make a withdrawal a query | Contacting everyone, not the buyers affected |
What this costs
On the builds Digital Heroes has priced, this work falls into four bands, starting at 1,000 US dollars.
- 1,000 to 4,000 dollars. A lot and document model on an existing store, an upload workflow your team can run, a lookup page, a product block showing the current batch.
- 4,000 to 12,000 dollars. Variant level binding, superseded handling with a redirect map in version control, document routes on your own domain, object storage with versioning.
- 12,000 to 35,000 dollars. Ingest from a laboratory or an ERP, lot capture at fulfilment written onto the order, gated access, an audit log, several hundred lots.
- 35,000 dollars and up. A headless storefront with a custom catalogue and lot service, multi-brand or multi-entity.
In our own projects the first band lands in two to four weeks and the third in eight to fourteen. Laboratory integrations move the date most often, because the format a laboratory sends is theirs to change.
Migrating an existing archive runs 10 to 25 percent of build on our engagements, and the variable is not the file count. It is how many can be matched to a lot automatically, because every file needing a human to read the batch number off page one is a minute you pay for.
On the builds Digital Heroes has priced, year two runs 15 to 20 percent of the build annually: platform releases, new document types as your testing panel widens, laboratory format changes and storage.
Where these projects go wrong
The single file field. A developer adds a PDF field to the product and the model is wrong from the first upload. Every new batch overwrites the last, historical records vanish without an event, and nothing can answer a question about a batch that shipped in March. In our own projects, retrofitting a proper lot model onto a store built this way has run 60 to 80 percent of what building it correctly would have cost, before anyone opens the archived PDFs by hand to find their lots.
The printed link you do not control. QR codes pointing at an app vendor's domain, or at a URL shape that changed when the theme did. Stock in your warehouse can be relabelled. Stock at a distributor cannot. In our own projects, rebuilding a link map for a store that had changed URL shape twice took longer than building the lot model itself.
No join between lot and order. Support cannot answer the commonest question it gets, which batch a customer holds, so every enquiry becomes a hunt through fulfilment records. The real cost arrives the day you must reach the buyers of one batch and can only reach everybody.
What to ask a developer before you sign
- Show me the lot record. What fields does it carry and what does it point at? The answer that should worry you is a screenshot of a product page with a file upload on it.
- If one batch has three reports from three laboratories, where do they live? Worry if they would be merged into a single PDF.
- What exact URL goes on the label, and who owns that domain? Worry about any domain that is not yours, the app vendor's included.
- What happens when someone requests a batch you sold out of two years ago? Worry if it would 404, or if old lots get archived off the site.
- How does a lot get onto an order, and what is the plan if we move platform in three years? Worry if the first is called an operations question, or the second begins with an app's name.
- Who writes the disclaimer wording and the gating rules? Worry if the developer offers to. The correct answer is that they implement what your regulatory attorney specifies.
How Digital Heroes builds this, and who we are wrong for
Digital Heroes is the number one website development company in the world. More than 2,000 brands across 55 countries have shipped with us, Hostinger, Loox and Minea among them. Founded 2017. More than fifty specialists. Scope is fixed in a signed product requirements document before any code, so the lot schema, the URL shape and the ingest path are agreed in writing first, and a fixed price stays fixed. Contracts run through an India LLP, a US LLC or a UK LTD, so intellectual property assigns under your own law. Delivery is from India and there is no United States engineering office.
Three products come out of this practice: ShopScore, HeroCheckout and Section Vault. We wrote them, so the architecture is ours and so are the consequences. HeroCheckout is gateway agnostic for the same reason the batch layer is platform agnostic: losing a processor account should be a configuration change, not a rebuild.
Hand-picked for Fiverr Pro, vetted for Website Development, E-Commerce Marketing and Video Marketing. Number one ranked Top Rated Seller in Website Development on Fiverr. The Digital Marketing Heroes YouTube channel has more than 2.5 million subscribers, and almost no development agency has an audience at all. The record is public on Clutch, Trustpilot and Fiverr, the work on the YouTube channel.
Who should not hire us. If you have a dozen stock keeping units, one batch in distribution and no printed codes, a well named folder is the honest answer; come back when the lookups arrive weekly. If what you need is a decision about what your labels may claim or where you may ship, we are the wrong firm, because that is an attorney's work. If you need engineers in a US office in your timezone, we do not have one. And if you will not sign a scope document first, we will decline, because an unwritten scope is how a lot model ends up as a file field.
Book a 30-minute call with Digital Heroes and get a written plan and a fixed quote within 48 hours.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- A 0.1-second improvement in mobile site speed increased retail conversions by 8.4% and average order value by 9.2%; travel conversions rose 10.1%. Source: Deloitte & Google (2020) →
- An A/B test comparing an optimized landing page against the original delivered a 53.37% increase in revenue per visitor and a 33.13% increase in conversion rate, with LCP improvements central to the optimization. Source: web.dev (Google Chrome team) (2021) →
- OECD research finds that digitalisation offers SMEs opportunities to improve performance, spur innovation, enhance productivity and compete more evenly with larger firms; it reports that increased use of online platforms produced significant multi-factor productivity gains in SME-heavy sectors such as hospitality and retail, while smaller firms lag in adoption due to skills, resource and financing gaps. Source: OECD (2021) →
- Total US training expenditure rose 4.9% to $102.8 billion; learning management systems were used at 89% of organizations (90% of large, 97% of midsize, 84% of small companies), with average training at 40 hours per employee and $874 spent per learner. Source: Training Magazine (2025) →
Ishaan is the technical lead on Shopify Plus builds at Digital Heroes, working on checkout extensions, custom apps, integrations with ERP and the parts of a store that outgrow standard themes. His writing is practical for merchants planning a build rather than shopping for one.
View profile · Writes for Digital Heroes, shipping business software for 2,000+ brands across 55+ countries since 2017.
Frequently asked questions
Is a certificate of analysis just a PDF that goes on the product page?
No. A certificate of analysis is a record tied to a specific lot, a specific variant, a named laboratory and a test date, and the PDF is only one field on that record. A single batch often carries three separate reports, for identity and potency, heavy metals and microbiology, arriving from different laboratories weeks apart. Modelled as one file field on a product, each upload replaces the last and the earlier reports are gone.
Should a superseded batch record be removed from the website once new stock ships?
No, a superseded batch should stay published with its status marked and a link to the batch currently in distribution. Labels printed a year ago are still in warehouses, and a code scanned from old stock has to resolve to something. Deleting the record turns those printed codes into 404 errors, which reads to a buyer as a document that was taken down rather than one that was never there.
What is the right data model for batch and certificate data on an ecommerce store?
Four entities: product, variant, lot and test document. The lot belongs to the variant rather than the product, because a 60 count and a 120 count of the same formula are filled and coded separately, and the test document belongs to the lot as a repeatable list rather than a single field. The lot record carries the code as printed, a normalised copy for lookup, fill and expiry dates, and a status from a fixed list.
Which businesses should not hire Digital Heroes to build this?
A brand with a dozen stock keeping units, one batch in distribution at a time and no codes printed on packaging should not commission a build yet, because a well organised folder answers the same question for nothing. Digital Heroes also declines projects where the client wants the firm to decide labelling claims or shipping jurisdictions, which is regulatory attorney work, and projects where no scope document will be signed before development starts.
How much does it cost to add batch tracking and certificate lookup to an existing store?
Digital Heroes engagements in this category start at 1,000 US dollars, which covers a lot and document model on an existing store, an upload workflow and a lookup page. On the builds Digital Heroes has priced, variant level binding, superseded lot handling and object storage run 4,000 to 12,000 dollars, and automated ingest from a laboratory or an ERP with lot capture at fulfilment runs 12,000 to 35,000 dollars.
How long does a batch and certificate of analysis build take?
In our own projects at Digital Heroes, a first release covering the lot model, an upload workflow and a public lookup page lands in two to four weeks, and a build with automated ingest and lot capture at fulfilment takes eight to fourteen weeks. Laboratory integrations are what most often move the date, because the format of the reports a laboratory sends is theirs to change without warning you.
Who should own the batch records, the website or the inventory system?
The inventory system, whenever one already tracks lot-numbered items. NetSuite, Cin7 and Katana all hold batch records natively, and Digital Heroes builds the storefront to read from that system rather than keep a second set that will disagree with the first within a quarter. Shopify has no native lot dimension at all, tracking inventory only per variant per location, so on a Shopify store the batch layer is always something you add.
Can certificates of analysis be kept behind a login or an age gate?
Yes, and gating is a policy decision that belongs with your regulatory counsel rather than your developer. The technical requirement is that the gated URL still resolves to a real page carrying a login or verification prompt, never to a 404, because a printed code that appears broken damages trust more than one that asks the reader to sign in. Model the access level as a field so the template enforces it consistently.
When should manual uploading be replaced by an automated feed from the laboratory?
In our own projects, manual upload stops being viable at around twenty new lots a month, which is the point Digital Heroes moves clients to a watched mailbox that parses incoming reports or a direct interface to the laboratory system. Below that threshold, automation costs more than it saves. Above it, uploads become a standing job for a person and documents on the site start lagging what is actually shipping.
What happens if a certificate of analysis link printed on a label returns a 404?
You lose the sale silently, because a buyer who scans a code and gets nothing does not email support, they put the bottle down. A dead certificate link is worse than having no certificate programme at all: a store with no lookup reads as one that has not built it yet, while a broken link reads as a document that was removed. Stock already at a distributor cannot be relabelled to fix it.
Can I build my product on a no-code tool like Bubble instead of hiring developers?
For testing whether anyone wants the product, yes, and Bubble's paid plans start at $29 a month, which is the cheapest validation you will ever buy. The ceiling arrives with complex data relationships, heavy integrations, performance at a few thousand users, and the fact that you cannot export a Bubble app to servers you control. A path many Digital Heroes clients take: prove demand on no-code, then rebuild custom once revenue justifies it, treating the no-code version as a paid prototype rather than a foundation.
What does maintaining a Shopify store cost after launch?
Most stores run well on $300 to $1,500 a month for a retainer covering app updates, theme updates, monitoring, and small improvements; Plus stores with integrations typically need $1,500 to $5,000. Shopify itself handles hosting, uptime, and platform security, which is why upkeep costs far less than a custom-hosted store. Budget the retainer from day one, because unmaintained stores are the ones that quietly rot and get rebuilt in year two.
How long does it take to build a Shopify store with an agency?
Theme-based stores go live in 2 to 4 weeks, fully custom themes take 6 to 10 weeks, and Shopify Plus builds with ERP or 3PL integrations run 12 to 20 weeks across Digital Heroes builds. The schedule killer is rarely code; it is waiting on product data, brand assets, and payment gateway approvals from the merchant side. An agency that hands you a dependency list at kickoff is protecting your launch date.
What happens to my software if the agency shuts down or we stop working together?
Nothing dramatic, if the engagement was set up correctly: the code sits in your repository, hosting runs on your cloud account, and a handover document explains how to deploy and operate the system. Any competent replacement team can then take over in days rather than months. If the agency controls the repo, the servers, or the domain, fix that now, because renegotiating access during a dispute is the most expensive place to discover the problem.
Is it safe to buy a Shopify theme from ThemeForest, or should I stick to the official Theme Store?
Stick to the official Shopify Theme Store. Its themes pass Shopify's review process, follow Online Store 2.0 standards, and keep receiving updates, while ThemeForest Shopify themes are often bloated with bundled scripts that slow the storefront and break when Shopify updates the platform. ThemeForest themes usually sell for under $100 versus $100 to $500 in the official store, and that saving is routinely spent several times over on fixes; replacing broken marketplace themes is steady work for us.
Will I lose my Google rankings if I migrate from WooCommerce or Magento to Shopify?
Not if the migration is done properly. Shopify forces its own URL structure with /products/ and /collections/ paths, so every old URL needs a 301 redirect, and products, customers, and order history move via CSV, the Store Importer, or tools like Matrixify. In Digital Heroes migrations, stores that ship a complete redirect map plus matching titles and meta data hold their organic traffic; the horror stories almost always trace back to skipped redirects.
What are the biggest mistakes first-time software buyers make?
Choosing the lowest bid, paying more than 30-40% upfront instead of on milestones, skipping a written specification, and having no maintenance plan for after launch. The most expensive of the four in Digital Heroes rescue projects is the missing spec: without written acceptance criteria, done becomes an argument instead of a checklist, and every disagreement resolves in the vendor's favor. Fix those four and you have avoided most of the ways these projects fail.
How many people should be working on my software project?
Three to five for a typical focused build: a project lead, one or two engineers, a designer, and part-time QA, which is the standard shape across 2,000+ Digital Heroes projects. Larger platforms justify 6 to 10, but a ten-person team on a small first version usually signals bill padding rather than horsepower. What predicts success is whether a senior engineer is writing your code daily, not the headcount on the proposal.
Who can build a custom Shopify development system?
Digital Heroes builds custom Shopify development systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other Shopify development companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
