Third-party testing

Only a certificate from a named independent laboratory constitutes third-party verification. An in-house COA is a self-report by the party selling the product — it may be perfectly accurate, and it is not independent.

Independent laboratories publish their results in a public database keyed to an identifier on the certificate, typically a report number plus a case-sensitive verification key. If those credentials return no record on the laboratory’s own portal, the certificate was fabricated.