Custom chain of custody software for FSC and PEFC
The most stubborn misconception in this area is that an FSC or PEFC certificate helps you comply with the deforestation regulation. It does not do so automatically. Chain of custody proves that material from a certified source has moved through your supply chain; the EUDR requires data that is not part of it, starting with the geolocation of the plot.
Two record-keeping systems that look alike
Chain of custody is the system of tracking: it follows certified material from forest to end product. The systems work with fixed methods. With physical separation, you keep certified material apart from non-certified material; with the percentage method, you pass on a share to the outgoing batch; with the credit method, you build up a balance that you can claim later. Which method you use determines what your records look like.
The deforestation regulation asks for something different. It is about due diligence: demonstrating that a product is deforestation-free and legally produced, with geolocation data for the plots where the raw material comes from. Both PEFC and FSC have published a separate module on top of the CoC standard for this purpose, precisely because the basic standard does not cover it. The regulation applies to large companies from 30 December 2026, and to small and micro enterprises until the end of June 2027.
The practical consequence is that you keep two tracks for the same batch of timber. Anyone who crams them into one spreadsheet discovers at the first audit that the percentage calculation no longer adds up once geolocation fields are added, or that a credit record cannot answer the question of which plot this plank came from. These are not shortcomings of your records but of the assumption that it is a single record-keeping system.
How we build this
The batch is the unit here, and the method determines the calculation rules. If, for each incoming batch, it is clear what it is and what happens to it, then every claim follows from that.
Physical separation, percentage or credit, and sometimes different methods per product group. This is the first question and it determines the entire setup; skipping it leads to a system that calculates in a way nobody actually works.
For each outgoing batch, which incoming batches it contains. With physical separation this is a reference, with percentage a calculation, with credit a debit.
Geolocation, supplier and country belong to the incoming batch, not to the claim. We build them as a separate layer, so that one does not collapse when the other changes.
We take an outgoing batch from last year and trace it back. Whatever fails to trace will fail at the audit too.
What the software actually does
The batch administration carries everything; the claim and the due diligence data are two layers on top of that. Which components you need depends on your method and your position in the chain.
Inbound and outbound lots integrated
For each outgoing batch, which incoming batches are included, with quantity and unit. This is the core of every chain of custody and, at most companies, the weakest point.
Calculation rules per method
Percentages and credits are calculated according to the method you apply, with the intermediate steps visible. A claim whose calculation cannot be traced will not hold up in an audit.
Supplier certificates monitored
Validity, scope and expiry date per supplier, with a warning before a certificate expires. An incoming batch dated after the expiry date invalidates the claim based on it.
Due diligence data as a separate layer
Geolocation, country and supplier for the incoming batch, kept separate from the CoC claim. This lets you substantiate an EUDR declaration without cluttering your certification records. See also EUDR software.
Claim per batch documented
Which claim was made on which outgoing batch, on which date and on what basis. In an audit, it is not the claim itself that matters but the evidence underlying it at the time.
Deviations with follow-up
A batch without a valid certificate, a percentage outside the permitted range, missing geolocation. Each of these becomes an action with an owner rather than a line on a list.
Who we build for
Your position in the chain determines which method and which data apply to you. Four situations.
Timber trade and building materials
You buy in and sell on, often without processing. Your challenge is the link between the supplier lot and the sales order, and that link currently usually sits in a stock system that doesn't know about the claim.
Processors and manufacturers
You blend batches, and then the method becomes decisive. With percentage or credit methods the administration is heavier than with segregation, and the gain lies in calculating automatically rather than reconstructing afterwards.
Packaging, paper and print
Your customers ask for a claim on the finished product while you are far from the forest. The chain is long and the data comes from your supplier; a portal works better here than an exchange of emails.
Projects with a certification requirement
In tenders, a claim is requested per delivery, not per company. That means you must be able to show, for each project, which batches went into it. Recording on site runs through the batch provenance app.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →Technology and integrations
The standards and the EUDR modules are still being revised. Anything involving calculation rules and fields should be configurable and retained per version, so that an older claim remains legible against the rules of the time.
Why Appfront
A certificate is not a due diligence statement
Chain of custody supports the EUDR but does not cover it. We build both layers separately and make clear where one stops and the other begins.
The method determines the system
Segregation, percentage and credit each require a different administration. We start from your method rather than from a standard model.
An expired certificate invalidates claims
We monitor validity and scope per supplier and warn in advance, because discovering it afterwards means reversing claims.
Your stock system stays in place
Lots and quantities already exist somewhere. We connect to them through integrations rather than building a second stock administration.
Security and privacy
The data here is commercially sensitive on two fronts. Your purchasing relationships with suppliers, including volumes and prices, are valuable to a competitor, and the geolocation data your supplier provides would reveal their own sources. The portal therefore shows a supplier only their own lots, and origin data is shielded from anyone who doesn't need it.
On the evidence side, there is a requirement that makes this record-keeping particularly demanding. A claim must still be justifiable years later against the standard version that applied at the time, even if the standard has since been revised and the supplier no longer exists. We therefore keep the supplied values as they originally arrived, the rule version used for the calculation, and the claim as it was made. A system that only knows the current state cannot explain, during an audit, why a lot was assessed differently at the time. For how we handle security ourselves, see our information security policy; reports from outside should go through our coordinated vulnerability disclosure policy.
Frequently asked questions about chain of custody
No. Certification supports your due diligence system and strengthens the evidence, but the regulation requires data that the base standards do not capture, particularly the geolocation of plots. Both schemes have therefore published a separate module on top of chain of custody. Check with your certification body what that means for your scope.
That depends on your process. Physical segregation is the simplest administratively but requires space and discipline in the warehouse. The percentage method and the credit method offer more flexibility but require more administration. We build the calculation rules around the method you apply; which methods are permitted for your product group is determined by the standard.
For large companies from 30 December 2026, and for small and micro enterprises until the end of June 2027. Note that timber has its own position under this regulation. Check the current dates and your category, as this regulation has been amended several times in recent years; see also EUDR software.
A stock system knows how many cubic metres are on the shelf and what they cost. Chain of custody knows which incoming batch is in which outgoing batch and which claim rests on it. That is a different question about the same shelf. We therefore integrate with what you already have; see timber trade software.
For importers, this is the most difficult part, and it does not resolve itself. What works is keeping the request small, in your supplier's language, with a clear view of what is still missing, and starting early, because the first round rarely yields usable answers. Without that data you cannot substantiate a declaration, however good your certificate is.
Longer than most companies expect, and the periods differ by standard and by regulation. In practice, this means the justification for a claim must remain readable even if the standard version has been revised and the supplier has disappeared. That is why we keep the supplied values and the rule version alongside the claim itself.
Yes, and this is often necessary because customers ask for different claims. The lot administration is shared; the calculation rules and claim definitions differ per scheme, so we keep them configurable. What you do not want is a separate administration per scheme, because the lot data then drifts apart.
That depends on your method, the number of product groups, and whether the supplier portal and the EUDR layer need to be included. The batch administration with the claim calculation is usually quick to put to use; the portal and integrations cost more. We provide a substantiated estimate after the discovery phase.
Getting claims substantiated?
Take an outbound batch from last year and try to trace which inbound batches went into it and which certificate applied at the time. Wherever that trail goes cold, the work lies. We build this as a standalone application and as part of a broader custom software project.