Skip to Content
COLAs

COLAs (Certificates of Label Approval)

A COLA is the federal pre-approval that lets you sell a labeled alcoholic beverage in interstate commerce. Every finished good that ships across state lines needs one. vestl tracks COLAs against products and stores the supporting artifacts (label artwork, submission PDFs, approval letters) so a TTB filing or audit can be reconstructed without leaving the app.

The COLA lifecycle

A COLA moves through four statuses:

  • Draft — created in vestl, not yet submitted to TTB.
  • Submitted — sent to TTB; awaiting their decision.
  • Approved — TTB issued the COLA; the product can ship under that label.
  • Rejected — TTB refused; the COLA holds the rejection reason for the record.

A fifth status, Superseded, applies when a new COLA replaces an old one (e.g. a label revision). The old COLA stays in the system as historical record; the product points at the new approved one.

Artifacts

A COLA without its artifacts is just an ID number. vestl stores up to four kinds of files per COLA, all attached on the COLA detail page (/compliance/cola/[id]):

KindWhat it isWhat we accept
Label ArtworkThe actual label image submitted to TTBJPEG or PNG, max 1.5 MB
Submission PDFForms, declarations, the full submission packagePDF, max 5 MB
Approval LetterTTB’s issued approval (or rejection notice)PDF, max 5 MB
OtherAnything else relevant — internal notes, draft revisionsAny file type, max 5 MB

Why these limits

The Label Artwork rules track TTB COLA Online  directly: TTB accepts JPEG primarily and PNG as a fallback when label text isn’t legible as JPEG, both at ≤ 1.5 MB. If a file would be rejected by TTB, vestl rejects it with the same message so you don’t waste a submission attempt finding out.

TTB also asks for 120–170 DPI on label artwork. vestl doesn’t enforce DPI — that’s the operator’s responsibility before upload — but the rule is the same.

Versions

Every upload of a given kind on a given COLA increments the version number for that kind. Old versions are preserved — they’re never deleted on replace. This is on purpose: TTB record-keeping is forever, and an audit asking “what was the artwork when this COLA was filed?” needs an answer that doesn’t depend on whether someone re-uploaded a new copy later.

If you need to remove a specific version (e.g. it was uploaded to the wrong COLA), use the Delete button on that row. Every delete is recorded in the audit log along with who did it and when.

Common workflows

Filing a new COLA

  1. Open the product detail page (/products/[id]). If there’s no COLA yet, click Create COLA → in the Label / COLA card.
  2. The new COLA is created in Draft status. You’ll land on its detail page.
  3. Upload the label artwork: pick Label Artwork in the kind picker, choose the file. The hint text below the picker reminds you of the format and size limits.
  4. Upload the submission PDF the same way (kind: Submission PDF).
  5. When you submit to TTB Online, click Submit to move the COLA to Submitted status in vestl.
  6. When TTB issues the approval, attach the approval letter (kind: Approval Letter) and click Approve. The product’s Label / COLA card now shows the approved COLA with its TTB COLA ID and expiration date.

Replacing an approved label

  1. Open the COLA detail page for the existing approved COLA.
  2. Click Supersede. vestl creates a new draft COLA pointing at the same product and links the new COLA’s supersededBy reference back to the old one.
  3. File the new COLA the normal way (artwork, submission, approval). When approved, the product automatically points at the new COLA. The old one stays in the system as historical record.

Auditing a COLA after the fact

Open the product detail page → click View COLA Details → on the Label / COLA card. The COLA page shows status, dates, every artifact version with a download link, and a timeline of status changes. Every artifact upload and delete is captured in the audit log.

Storage configuration

Artifact uploads need an S3-compatible bucket. In production this is Railway Buckets; the relevant environment variables are:

STORAGE_BUCKET_NAME
STORAGE_BUCKET_ENDPOINT
STORAGE_ACCESS_KEY_ID
STORAGE_SECRET_ACCESS_KEY

If any of those are missing, the upload UI returns a 503 with a copy-paste-ready message identifying which env vars to set. Local dev does not get a bucket out of the box — see the platform-reset runbook for setting one up.

Last updated on
Certificate of AnalysisReceipt exceptions