CARO is Spherity's web-based solution for authenticating direct and indirect authorized trading partners, verifying licenses, and enabling Drug Supply Chain Security Act (DSCSA) compliance in the US pharmaceutical supply chain.

Pharmaceutical supply chain stakeholders, i.e. manufacturers, repackagers, wholesalers, 3PLs, dispensers, and enterprises looking for efficient DSCSA Authorized Trading Partner (ATP) verification and master data management.

Electronic or so-called Verifiable Credentials are digital representations of real-life certified facts, for example your company registration details. These can be shared in a completely hands-off manner allowing for efficient process automation.
Using CARO, credential details of your DSCSA-relevant authorized status are automatically embedded into messages between you and other businesses, such as Product Identifier verifications with manufacturers. This way, you can both trust that your communication is compliant with DSCSA Authorized Trading Partner (ATP) requirements. Regardless of whether your counterparty is a direct or indirect (no prior relationship) trading partner, you can be sure that the message has come from them in a secure and efficient way.

You only need to acquire an ATP credential once, as it can be reused in multiple business interactions through your trading partner hub.

​To establish that your organization itself is legitimate, you need to get your Identity credential first.
 • Provide certain pieces of evidence to the integrated credential issuer, Legisym.
        > Check if your company has a DEA Signing Certificate. It is the fastest way. (Note that it is rare for manufacturers to have one.)
        > If not, submit corporate documents instead.
 Thereafter, you can get your ATP credential.
• Provide certain pieces of evidence to the integrated credential issuer, Legisym.
For more information please read how to get started here.

We work with all active VRS providers that are aligned with OCI to ensure interoperability as well as common security and quality standards between the services. You can view the OCI-aligned service providers or check CARO ecosystem above.

CARO provides essential details, such as your unique Enterprise Account identifier, automatically to your VRS providers once they have been granted the relevant account access. In addition, your VRS requires the GLN that you want to use for product verifications or other interactions. Please contact your VRS directly to provide any further details and learn more.

Yes, for master data syncing with ERP/compliance systems, license monitoring, audit reports, and consistent data management beyond DSCSA.

Yes. In principle, there are two options:

1. You can manage several distinct Enterprise Accounts in your digital wallet if you have been invited as a user to these Enterprise Accounts. So, for example, if you want to join as an Account Administrator for 5 of your enterprise’s subsidiaries, each one of these verified entities must add you as an Account Administrator in the User Management module. Once you have accepted the invite, you will see each of these 5 subsidiaries as separate Enterprise Accounts within your wallet. You can also be set up in different user roles for different Enterprise Accounts.
2. You can manage several entities within the same Enterprise Account if it is OK to share data and user access between these entities.Feel free to discuss with us which option might be more suitable to your business needs.

Free trial or starter options are available. Please contact us for details. 
Additionally, the free Movilitas DSCSA app enables small pharmacies to access the VRS network securely. Unlock the app with our DSCSA credentials. You can see how to set up Movilitas DSCSA here.