004TEXTILE TRADE, OSAKA · 2026
3
VERDICTS PER CHECK
GOTS certification: a tracker that holds up in front of the auditor
A textile trader in Osaka prepared its first GOTS audit under version 7.0. There was no tool for it. Kuroko Labs built the tracker: it reads the registered SharePoint libraries every day, computes the mass balance per stage, knows three verdicts and records every change with an editor ID and a timestamp.
4
Tabs
dashboard to trail
3
Verdicts
conformant, violation, undeterminable
13
Editors
with no other rights
07:50
Source check
daily, Japan time
11,700+
Documents read
every cell with its source file
01 · THE CHALLENGE
What a GOTS audit requires
GOTS, the Global Organic Textile Standard, is not a test you pass once. It is a claim: this fabric is organic cotton, and here is the unbroken chain of custody, the term the standard uses for the evidence trail. The chain starts at the first processing stage, the spinning mill, not in the field. Every company in the chain holds a Scope Certificate (SC) for its materials and processes; every delivery of certified goods carries a Transaction Certificate (TC). The claim has to hold when somebody from the certification body sits down at the table, pulls documents and interviews staff.
For a textile company with a trading arm in Osaka and two factories in Thailand, the date was set: September 2026, an audit under GOTS version 7.0, scope trader. A trader proves that certified goods were kept separate, labelled correctly and passed on with a TC. It does not have to prove how the fabric was made.
There was no tool for this preparation. The evidence sat where it is created day to day: certificates as PDFs, traceability sheets and shipping invoices on SharePoint. What was needed was one place that answers a single question at any time: if the auditor asks today, what can we show, and what can we not?
SC
Scope Certificate
for every company in the chain
TC
Transaction Certificate
per delivery of certified goods
7.0
GOTS version
scope trader
?
What can we show
if the auditor asks today
02 · THE SOLUTION
How do you prepare a GOTS audit without fooling yourself?
The tracker does not store the evidence. It reads it where it lives and answers the audit question as honestly as the data allows. Four tabs, in the order you need them on audit day: dashboard, supply chain and certificates, traceability, evidence and trail.
01
SCOPE CERTIFICATES
Collected, chain clarified
Week 1
02
PROTOTYPE
Released to managers
Week 2
03
SOURCES
Libraries registered, corrections
Weeks 3 and 4
04
FOUR TABS
Scope settled, tabs final
Week 6
First, the scope certificates of every company in the chain were brought together, with validity and certified materials. That fixed where the chain starts: at the spinning mill. A farm certificate does not exist under GOTS, so the tracker does not ask for one.
Then the managers saw a prototype in the dashboard and decided which spreadsheets should be tracked automatically. Exactly those SharePoint libraries were registered. The tracker queries them through Microsoft Graph with delta queries, changes only, never a full scan. The finer points came from the first real use.
Finally, the scope was settled with the certification body. The fabric route through the trading arm is what gets audited. The garment route through the sewing factory runs without a GOTS claim for now, so it does not belong on the critical path of this audit. The result was four tabs, in the order of audit day.
03 · MASS BALANCE · EXAMPLE VALUES
The number the audit turns on
You cannot ship more certified goods than you received. The tracker reads every row from the source files, counts each stage once and puts both sides on the scale. The values here are examples, not customer data.
| Lot | Stage | In kg | Out kg | Document | Date |
|---|---|---|---|---|---|
| L-2607-01 | Spinning mill | 312.5 | · | TC 61-0412 | 04.08. |
| L-2607-02 | Weaving mill | · | 188.0 | DN 4471 | 06.08. |
| L-2607-03 | Spinning mill | 240.0 | · | TC 61-0418 | 08.08. |
| L-2607-04 | Trader | · | 142.5 | INV 26-118 | 12.08. |
| L-2607-05 | Spinning mill | 415.0 | · | TC 61-0431 | 15.08. |
| L-2607-06 | Weaving mill | · | 260.0 | DN 4498 | 19.08. |
| L-2607-07 | Trader | · | 199.5 | INV 26-127 | 22.08. |
| L-2607-08 | Spinning mill | 532.5 | · | TC 61-0447 | 26.08. |
| L-2607-09 | Weaving mill | · | 330.0 | DN 4512 | 02.09. |
| L-2607-10 | Spinning mill | 500.0 | 120.0 | TC 61-0455 | 09.09. |
| Total | 2,000.0 | 1,240.0 | |||
Result: within. 1,240 kg out against 2,000 kg in. If a weight is missing or unreadable, the scale does not tip to green, it shows "cannot be determined".
04 · ARCHITECTURE
Three rules for every number
01DASHBOARD
Open problems, ranked
Key figures, the audit milestones, then every open problem in order. An alert can be dismissed; the decision is reversible and carries the editor ID. If the underlying cause has since cleared, the alert says so instead of disappearing.
1
ranking
02SUPPLY CHAIN
Scope certificates with history
Every company in the chain of custody in order, with the status of its Scope Certificate, certified materials and expiry date. A renewal is added as a second row; the old one stays as history. A new SC arrives as a PDF, the system reads a draft, a person confirms it against the PDF.
2
rows per renewal
03TRACEABILITY
Mass balance per stage
Certified output must not exceed certified input. One running record per buyer, every cell leads to its source file. The overview across buyers counts each stage once at its own identifier and rules: conformant, check, cannot be determined.
3
verdicts
04EVIDENCE AND TRAIL
What is missing, and why
Critical documents with a deadline beside the audit checklist, among them the approved vendor list and the annual mass balance close. Every evidence source on SharePoint with a note on whether it is reachable. Documents no parser could read, with the reason. And the audit trail.
84,000
files searched
05ACCESS
Editing without full access
Two roles for the tracker only, reader and editor. Neither grants settings, data export or any other area. 13 people edit the tracker and hold no other right; every change carries their ID.
13
editors
The mass balance is the calculation the audit turns on: the certified output of a stage must not exceed its certified input, waste and rejects included. It lives on the traceability tab, one running record per buyer, every cell with the file it came from. For that number to hold in front of an auditor, every parser follows three rules.
First: three verdicts. Conformant, violation, cannot be determined. An empty list counts as cannot be determined, because no rows does not mean everything is right. Second: columns are found by their heading, never by position. Two versions of the same traceability sheet can easily differ by one inserted column, and read by position the yarn count would be counted as kilograms.
Third: a quantity that cannot be read unambiguously is refused rather than guessed. In "980,5" the comma can be a decimal point or a thousands separator, a factor of ten. That is why the code has exactly one definition of a readable weight, with tests per document type. Example values from a prototype never count.
05 · RESULTS
What the tracker does by itself, and what it does not
7 s
overview across buyers
11,700+
document files read
3
verdicts per check
0
data passed to third parties
REQUIREMENTEVIDENCEIN THE TRACKER
Chain of custodyValid scope certificate for every companySupply chain tab, expiry watched
Transaction certificatePer delivery of certified goodsAlert once a delivery is ready for a TC
Mass balanceOutput never above input, per stageTraceability, three verdicts
DocumentationEvery number with its sourceEach cell leads to its source file
Record of changesWho changed what, and whenAudit trail in the CSV pack
Every morning at 07:50 Japan time it checks whether every registered evidence source on SharePoint is reachable. On weekdays it recomputes the alerts every hour. It reads the traceability sheet and the master workbook with training, internal audits and sign-offs once a day. Every run is idempotent; running it again changes nothing that was already right. A file that cannot be opened turns its source red, and an import with zero rows does not count as success.
Everything else is done by a person: entering and correcting facts, declaring a document complete, dismissing an alert, and anything that goes to the certification body. The tracker sends nothing anywhere. Each of those actions lands in the audit trail, a table with editor ID and timestamp. The trail is part of the CSV pack for the auditor.
Personal data is processed in exactly one place: the editor ID and the time of a change, on the basis of the legitimate interest under Art. 6(1)(f) GDPR in a traceable certification, retained for the certification cycle. Access runs through the customer's Microsoft 365 tenant; the Microsoft Graph app permission is limited to reading the registered libraries. The tracker runs on a server owned by the customer and passes no data to third parties. The language model that reads a certificate draft from a PDF is switched off by default and never writes without a person's confirmation. None of this replaces legal advice; it keeps the data protection officer's review short.
The overview across all buyers loads in seven seconds. Around 11,700 document files have been read per buyer: shipping documents, export papers, delivery notes, confirmations, contracts, lot sheets. And about 84,000 files on SharePoint were searched to settle one question for the audit: an annual mass balance close is not there. It is listed in the tracker as an open item with a deadline.
“
Source files are checked daily and the register is re-read from the master spreadsheet automatically. The content itself is maintained by named people, and every change is recorded in the trail with the editor ID and the time.THE WORDING IN THE TRACKER MANUAL, WRITTEN FOR THE AUDITOR
TECH STACK
Node.js
Backend
Express
API
SQLite
WAL mode, one file, one backup
Microsoft Graph
SharePoint, delta queries, read only
PM2
Cluster, cron on worker 0 only
Vanilla JS
Frontend
CSV
Audit pack with trail
OUTLOOK
What remains open is what no software settles: the choice of farm and spinning mill, which sits with the buyer, and signatures under internal documents. The tracker lists these items with a deadline. Closing them is up to the organisation.
NEXT STEP
A Similar Project?
GET IN TOUCH ALL CASE STUDIESFrequently asked questions, GOTS tracker case study
Why does preparing a GOTS audit need a tracker?+
The evidence is created day to day in different places, as PDFs, spreadsheets or invoices. The tracker reads it from SharePoint every day, computes the mass balance and says for every number which file and which column it came from. If a source becomes unreadable, it reports that with a date.
What is the difference between a Scope Certificate and a Transaction Certificate?+
The Scope Certificate (SC) certifies a company, for a limited time, to handle specific materials and processes under GOTS. The Transaction Certificate (TC) certifies one delivery of certified goods between two companies. The chain of custody needs both: valid SCs for everyone involved and a TC per delivery. The tracker watches SC validity and reports when a delivery is ready for a TC.
How does the mass balance work, and why three verdicts?+
Per stage, the certified output quantity must not exceed the certified input quantity. The tracker counts each stage once at its own identifier and compares. If a weight is missing or ambiguous, the verdict is "cannot be determined" rather than green. That is the answer an auditor can respect, and it shows where somebody has to look.
Which personal data does the tracker process?+
Only the editor ID and the timestamp in the audit trail, on the basis of the legitimate interest under Art. 6(1)(f) GDPR in a traceable certification. Evidence files are business documents. Access runs through the customer's Microsoft 365 tenant with a read-only app permission on the registered libraries, the data stays on the customer's server, nothing goes to third parties. This does not replace legal advice.
How does the tracker read the documents technically?+
Through Microsoft Graph with delta queries on the registered SharePoint libraries. One parser per document type finds columns by their heading; one shared function decides whether a weight is readable. Results go into a SQLite database in WAL mode, the cron jobs run in the PM2 cluster on one worker only, every run is idempotent. The rules live in deterministic code with tests, not in the language model.
Can this be carried over to other certifications?+
The building blocks do not depend on GOTS: read registered sources daily, find columns by heading, refuse unreadable values, three verdicts, a trail with editor ID and time. Anyone who has to prove a different chain needs different rules, not a different tool. The first call and the potential assessment are free of charge.
Technology used
The tracker runs on SQLite with its own Node.js backend and reads SharePoint through Microsoft Graph. Standard parts, so that others can carry the work on.
The links lead to the documentation of each component.