Every DSCSA exception, caught and closed. With the record to prove it.
The Aeroz exception desk reads your EPCIS and transaction files, flags each misalignment in HDA’s categories, drafts the notice to your trading partner and keeps the suspect-product clock. A person at your company approves every send.
The data now mostly arrives. The misses still have to be caught, documented and closed, and most of the industry still does that by email. Start with a free replay: 60 to 90 days of your own past files, so the first thing you see is what the desk finds in data you have already lived through.
DSCSA exceptions, in three facts.
US DSCSA · misalignment exceptions · quarantine until resolved · records kept six years.
PDG’s exception-handling Blueprint, updated in January 2026, still relies on email for exception notices; automated EPCIS messaging is a future goal.
Source: IntuitionLabs, DSCSA EPCIS exception handling (Aug 2026)In its first DSCSA warning letter to a dispenser (1 April 2026), FDA found the firm’s response lacked the documentation to show its corrective actions.
Source: FDA warning letter 723267 (1 Apr 2026)DSCSA trading partners keep transaction information and transaction statements for at least 6 years.
Source: 21 U.S.C. §360eee-1
The misses in HDA’s own categories.
Each case is filed under the scenario names in HDA, Exceptions Handling Guidelines for the DSCSA, so your team and your trading partner are talking about the same thing.
Data issues
A GTIN, company prefix or location in the data that isn’t in your master data, or files that don’t follow the standard.
Product and data that don’t match
Product with no data, data with no product, short and over shipments.
Lot or expiry mismatches
The lot or expiry in the transaction data differs from what the 2D barcode on the package says.
Serial and aggregation errors
Serial numbers not found, duplicates, and cases whose contents don’t match their aggregation events.
Suspect product clocks
When a case turns suspect, the desk starts the clock, holds the record and drafts the notices for a person to approve. It never sends those automatically.
A closed record for each case
Every case keeps who saw what and when, what was sent and how it closed: the record an inspector or a partner can check.
Ninety days. Nothing changes in how you work.
Your past 60 to 90 days
You send the EPCIS files you received and sent. The desk replays them in detect-only mode and lists every exception it finds, beside your own log for the same period.
Beside your current process
The desk runs alongside your team on live files. It drafts notices but sends nothing, so it never duplicates what you already send to partners.
What each one caught
A written comparison: what the desk caught that your process missed, and the reverse. You decide whether to keep it.
People decide. The record can’t be rewritten.
A person approves every notice
The desk drafts; your team sends. A halt switch stops the desk acting at once without stopping it recording.
Records that can’t be changed
Case histories and custody records are append-only, hash-chained and sealed every four hours with Aeroz’s signing key, so any change is detectable. Everything exports for an auditor.
No patient data
Built for product and transaction data only. Notes that look like they hold patient details are refused.
Works with what you run
TraceLink, SAP ATTP, rfxcel, Antares Vision, LSPedia, Systech, or the files your wholesalers send. Aeroz runs on its own and connects only where you already operate a system.
The DSCSA exception desk, answered.
Do we have to replace our serialization system?
No. Aeroz reads the EPCIS files your system already sends and receives, from TraceLink, SAP ATTP, rfxcel, Antares Vision, LSPedia, Systech or your wholesalers. Nothing in your current process changes during the pilot.
Does anything get sent to our trading partners?
Not during the pilot. Replay only detects. In shadow mode the desk drafts notices but nobody approves them, so nothing duplicates your own notices. After the pilot, every notice still waits for a person, and suspect-product notices are never sent automatically.
Is patient data involved?
No. The desk is built for product and transaction data only. Notes that look like they hold patient details are refused, and returns records with prescription labels should be stripped before upload.
What files do you need?
Sixty to ninety consecutive days of the EPCIS documents you received and sent (EPCIS 1.2 XML or 2.0 JSON-LD), split so each file holds no more than 2,000 unit events. Your own log of exceptions for the same period is how we measure the pilot.
Who sees our data?
Cloudflare hosts the service and runs the AI models that triage cases and draft notices, so case text stays inside Cloudflare. Resend sends only sign-in codes and notices a person has approved. Your data is never used to train a model.
Do you have SOC 2?
Not yet, and there has been no third-party penetration test. We run continuous adversarial testing against our own system and a person reviews every fix before it ships. Our security one-pager and subprocessor list come with the pilot agreement.
What does it cost after the pilot?
The pilot is free. If you want to keep the desk, we quote it at the readout, based on what the replay and shadow weeks showed.
See what the desk finds in your own files.
Thirty minutes: we show the desk on sample files, then agree the date range for your replay.