The document behind a certificate, such as a lab report or an organic certificate, is stored with your company's documents. You decide who may open it, and every opening from outside your company is recorded.
What is stored and checked
When you attach a certificate, the file (PDF, image, XML or JSON, up to 20 MB) is checked for malware before it is kept, then stored encrypted. A PDF that carries scripts or embedded files is refused. PDF and image pages are drawn as page images, so people read the pages without opening the file itself. The certificate records the file's fingerprint: a short code computed from its exact content.
Reading documents is not set up yet
A file that came in by WhatsApp or e-mail and was filed as a certificate's document is normally read: its fields wait on the document page in Certificates for a person to confirm. When the page says Reading documents is not set up yet., no document reader is set up for your company, so nobody read the fields. Nothing is lost: the document is stored and checked like any other, with its fingerprint. Enter the fields yourself on the document, or ask your admin to set reading up. This is not the same as AI document reading is off for this company, which an owner or admin chose in Settings → AI.
Who sees a certificate document
Under Who can see this document, a document is Only our company or Also companies we share certificates with, for the lots we deliver to them. Shared does not open it to anyone yet: for each connection, and for each verifier access, your company chooses what they may do. The default is See that they exist (name and fingerprint only); the other choices let them view the pages, or view the pages and download the originals.
Pages seen from outside your company are marked as a viewing copy for the reader; your own members and approvers see them unmarked. Each view or download uses a link that lasts five minutes, and an original can be downloaded once per link. Copies already downloaded cannot be taken back.
Who opened this document
The document page lists, under Who opened this document, each time a connected company or a verifier listed, viewed or downloaded it: who, what, when and through which connection or access. The first time a company or a verifier opens a document, your company gets a notice in its language. In Certificates ▸ On the lots, the Document column then shows Opened outside N times.
Public documents
A public document can be opened by anyone at its public address. On the document page, under Public, a member who may publish selects Ask to make public and confirms This document holds no personal data, or we may publish it. A second member then selects Approve and make public or Reject; the member who asked can Withdraw the request. Each step asks you to confirm it is you.
What a fingerprint check shows
A matching fingerprint shows only that the file is byte for byte the same file the certificate recorded, and which company recorded that certificate and when. It does not show that the document is genuine, that what it says is true, or that the issuer wrote it. A file that does not match may still be a re-saved or re-scanned copy of the same paper. The ledger records who declared what, when, and with what evidence.