Chain of custody for a peptide sample, explained

Where does the term come from?

It comes from evidence handling. A NIST definition describes chain of custody as a process that tracks the movement of evidence through its collection, safeguarding and analysis lifecycle, by documenting each person who handled it, the date and time it was collected or transferred, and the purpose of each transfer (NIST glossary).

The same idea applies to a vial of peptide. A test result is only as useful as the link between the result and the thing you care about. Chain of custody is that link, written down.

Why does chain of custody matter for a peptide certificate?

A certificate of analysis describes whatever sample reached the laboratory. Without a custody record, nothing on the certificate says where that sample came from. A seller could send a specially prepared vial, or reuse a genuine certificate for a different batch, and the paper would look the same.

This is the gap that accreditation and a registered chemist's signature cannot close. They speak to how the analysis was done. Custody speaks to what was analysed.

What are the links in a peptide sample's chain?

1. Acquisition. How the vial was obtained. An anonymous purchase through a seller's normal checkout means the seller could not choose which vial was sent.
2. Intake. The sealed vial is photographed as received, its label recorded and then covered, and it is given a sample code.
3. Transfer to the lab. The vial travels sealed, ideally with a tamper-evident seal, and the lab logs it in under the code, not a seller's name.
4. Analysis and signature. The lab runs the ordered tests and its chemist signs the report against the same code.
5. Publication. The signed report is fingerprinted and published, so the result can be traced back along every earlier link.

How does a fingerprint protect the last link?

The weakest point in many chains is after the report is signed: a PDF can be edited. A cryptographic hash closes that gap. The US standard for secure hash algorithms explains that a message digest is used to detect whether a message has been changed since the digest was generated (NIST FIPS 180-4). Publishing the SHA-256 fingerprint of a signed report lets anyone check that their copy is the original.

How is chain of custody different from blind testing?

They work together but are not the same thing. Chain of custody is the record of who held the sample. A blind sample is one where the lab does not know whose product it is. Custody stops a sample being swapped; blinding stops the result being shaded. The lesson on blind testing explains blinding in full.

What breaks a chain of custody?

• A gap with no record: nobody can say where the vial was between two points.
• A seller choosing which vial goes to the lab.
• A sample that arrives unsealed, or a seal whose number does not match the log.
• A report that does not carry the same sample code or batch as the intake record.
• A published document with no way to check it against the signed original.

A break does not mean a result is false. It means the result can no longer be tied to a specific vial with confidence, and should be read as describing "a sample" rather than "this product".

How will the Tested.ph chain work?

When testing opens, each record will follow the five stations in the figure above: purchase or submission, intake and coding, analysis by the partner laboratory, a signed report with its SHA-256 fingerprint, and a public record with a task number and verification key. How it works shows each step, and verify is where a record can be checked. Tested.ph is not a laboratory: its role is the custody around the analysis, not the analysis itself.