What the ERRA mark attests
The mark is three bars, and each one lights only while a product's record holds the evidence for a stretch of its life and passes the checks that stretch runs. This page explains what each bar means, what darkens it, and what the mark deliberately refuses to say.
Who the standard is for
Somebody is going to swallow this product. That person cannot read the lab report behind it or call the supplier who sold the powder. They read a label and decide whether to believe it. The standard exists for them. Our route runs through brands and co-manufacturers, and the destination is the person it ends up in.
Most marks on a shelf come from a sample. A lab receives a jar, runs a panel, and issues a document about that jar on that day. That work is real and ERRA does not replace it. It answers one narrow question, once. They check the sample. We attest to the system.
Attestation is the honest word for what ERRA does, and the reason we do not use the other one. ERRA does not walk a facility or sign off on a product. It reads the operating record a brand keeps in ERRA, runs the checks in the standard against it, and states what that record supports right now. When the record changes, the statement changes with it. That is what continuous attestation means, and it is the only thing the mark claims.
The bars are evidence domains
Each bar in the E names a stretch of a product's life and the proof that stretch has to produce. They are not a list of modules you buy, and they do not track how much of ERRA a brand pays for. They track evidence.
The record is being built. Nothing is claimed yet, and the mark says so.
Formulation, labeling, and sourcing evidence, held by the brand and passing its checks.
Manufacturing and testing evidence joins it: batch and lot results, in-process checks.
The chain closed end to end, under the brand's own quality system. The full E.
Top bar, every ingredient: formulation, labeling, and sourcing evidence. Middle bar, every batch: manufacturing and testing evidence, meaning the batch and lot results and the in-process checks behind them. Bottom bar, every record: distribution and post-market, the chain closed end to end under the brand's own quality system. The bottom bar can only light when the other two are lit, because you can outsource the making but not the answerability for it.
A bar answers for one product, not for a company. A brand that holds thorough evidence on one line and thin evidence on another shows a different E on each, permanently, and that is the rule rather than a gap in it.
Held is not lit
Two things have to be true before a bar lights. The brand has to hold the evidence for that stretch, and the record has to pass the checks that stretch runs. A complete file with a failed check leaves the bar dark. So does a clean check with nothing standing behind it.
Missing data is dark too. The standard fails closed, so a bar lights on what the record proves and never on the absence of a complaint. Silence is not a pass. This is the part that makes the mark inconvenient, and the part that makes it worth having.
What gates the bar, and what travels beside it
The checks are the gate. Only a computed check against the live record can light a bar, and each one resolves to a yes or a no with a timestamp and a source behind it. No human vote is involved.
Two other things ride alongside the bar without gating it: where the evidence came from, and how strongly it is assured. A record can agree with itself perfectly and still be fiction. Every number can line up because the same hand typed all of them on the same afternoon. Checks cannot tell that apart, so provenance and assurance are published beside the mark instead of being folded into it. You get to see whose system the evidence came from and how it was attested, and you get to weigh that yourself rather than take our arithmetic on faith.
Evidence imported from a system ERRA does not govern is a good example. It can be perfectly true and it still does not light the batch bar, because nothing about the way it arrived can be checked. It is disclosed for what it is: production self-reported, and not a claim about the lifecycle.
The bar goes dark the moment the record breaks
Because the attestation is continuous, the mark is a live state rather than a document with a date on it. The checks run as the record moves. When a check that was passing stops passing, the bar it belongs to returns to steel. There is no grace window, no quiet handling, and no account large enough to become the first exception. We would rather lose an account than dim what a lit bar means to the person holding the bottle.
Going dark is a color change and nothing more. No red, no scarlet letter stamped into the letterform. The alarm belongs in the record, where the person who can fix it will see it. And when the record is whole again, the bar lights again on its own: the same checks that darkened it are the ones that bring it back, with nobody to petition in between.
What the mark is not
Modules are bought. Bars are earned. Paying ERRA more does not move a bar, and no plan includes one.
There is no switch inside ERRA that lights a bar by hand. Not for a large customer, not for a founder, not for a friend. The checks light it or nothing does.
Nothing to frame, no year printed on it. A lit bar is the state of a record right now, and it is only as good as this morning.
An audit describes the days an auditor was in the building. The bars describe every day, because they read the record the work already leaves behind.
The mark speaks to the record behind the product: what went in, what was made, what was tested, where it shipped. Whether the product works for you is a different question, and an honest record is what lets anyone ask it.
One narrow mechanism exists, and it points away from the brand rather than toward it. If a defect in ERRA breaks a check the record actually passed, a documented two-person review can restore that one check, time-boxed to the fix and disclosed on the verification page. It corrects our measurement. It cannot excuse a brand's compliance, it cannot cover a second failing check, and it cannot hand a record a bar it did not earn.
You can already check a lot
The standard is still being written. The surface it will speak through is live today. A lot released through ERRA can carry a code that opens a public page for that lot, with no login and no account: the same page a person gets standing in their kitchen with the bottle in one hand.
That page states one of three tiers, in plain words. DOCUMENTED means the lot's production was recorded in ERRA. TRACED means the lot has a full recorded production genealogy. VERIFIED means the lot's sourcing, testing, and QA release all check out in the record. If the record carries documented exceptions, the page says how many. If the lot has been recalled, that notice comes before everything else on the screen.
It is a receipt, not a promise that the product is good for you, and it says so in those words. Same discipline the bars run on: state what the record supports, and stop talking.
Why any of this exists
Take the fear out of feeling better. Someone standing in an aisle, hoping this one finally helps, should not also have to hope the label is true. Everything above is machinery in service of that one sentence: paperwork turned into proof, so the deciding gets easier for the person at the end of it.
If you make supplements and you want to see the record this standard reads from, the conversation starts with the product, not with the mark.
The standard is in draft and the bars are not yet offered to customers. This page describes the doctrine ERRA is building to and holds itself to, so that it is on the record before there is anything to sell. ERRA performs deterministic regulatory math but does not provide regulatory or legal advice.