Certificates Guide

When an applicant uploads a resale or tax-exemption certificate with their registration, B2B Onboard reads the document for you and compares the key details against what they typed on the application. Instead of opening every PDF and checking it line by line, you get a clear summary of what matches and what doesn't — so you can review faster and approve with more confidence.

The app is built to help you evaluate each certificate, not to decide for you. It flags possible discrepancies and surfaces documents it couldn't read clearly; you make the final call on every application. A flag means "take a closer look" — it is not a rejection, and it does not block approval.

Availability: Certificate review is available on the Growth and Pro plans. Pro adds the existing-customer lifecycle — self-service certificate renewals and expiry reminders.

The flow is extract → flag → human decides:

1. Extract — when a certificate is uploaded, the app reads the document (AI/OCR) and pulls out the key fields: the legal business name, the issuing state, the tax ID, and the certificate's expiry date.
2. Flag — those fields are compared against the matching details on the application. The review panel leads with what disagrees: only mismatched fields are expanded into a side-by-side comparison, with columns labelled From application and From document. Fields that agree collapse into a single line (for example, "3 of 3 fields match the application"), available under Show details.
3. Human decides — you read the summary and approve, reject, or request more information. The app never auto-approves based on the certificate.

Expiry is handled too: if the certificate is past its expiry date, that's flagged; if it expires soon, you'll see a heads-up so you can decide whether to ask for an updated document.

For US resale and exemption certificates, the review panel also shows a States covered line — the US state or states the certificate applies to. For a standard single-state certificate that is the issuing state. For a multistate uniform form (the Multistate Tax Commission form or a Streamlined Sales Tax certificate), the app reads the per-state registration grid and lists each state where a registration number is entered; blank rows are ignored, and a registration number the app can't make sense of is noted for your review without changing the certificate's status. This line is there to help you see the scope of the exemption — it is informational and does not, on its own, apply any tax setting.

Registry check. For a US certificate, the review panel also shows a Registry check line — an attempt to see whether the buyer's permit exists in the issuing state's own records:

• Texas is checked automatically against the Texas Comptroller's public records. The Comptroller publishes this search so that vendors can "determine permit status of purchasers before accepting a resale certificate." The line shows a neutral status — Active, Inactive, Not found, or Lookup unavailable — and how the record was matched (by permit number, EIN, or business name).
• Other states that publish an online verification tool (for example California, Florida, and Georgia) show a one-click link to that official tool, the permit number ready to paste, and three buttons so you can record what the tool showed (Active / Inactive / Not found). The app doesn’t do the checking here — it gives you a shortcut; you make and record the call.
• Some states offer no online verification at all. The app says so plainly — No lookup available — rather than treating the absence as a problem.

Alongside it, an EIN consistency line reports whether the tax ID printed on the certificate matches the one on the application (Matches application / Doesn't match application / Not compared), and — where the state registry returned one — whether the registry's number agrees too. There is no public federal database to verify an EIN against, so this is a consistency signal, not a verification of the number itself.

Every part of the registry check is evidence to help you decide. It never approves or rejects anything, and an Active result is not a statement that the certificate is valid or that a sale is tax-compliant — that judgement is yours.

Each uploaded certificate carries one of five statuses. They describe a state — they are not a verdict on whether the certificate is genuine or legally sufficient. That judgement is yours.

• Collected Received but not yet processed. Nothing is required from you yet.
• Verifying The app is reading the document right now. This happens in the background — no action needed while it runs.
• Verified Every field the app compared matched the application. This means "no mismatches were found" — it is not a guarantee that the certificate is valid or legally sufficient.
• Flagged One or more fields don't match, or the certificate is expired or expiring soon. This is a prompt to take a closer look — it does not block approval.
• Needs review The document couldn't be read clearly, or the app wasn't confident in what it extracted. Open the certificate and check it manually.

Alongside the field comparison, the app shows how clearly it was able to read the document, as a plain-language band rather than a raw score:

• High — the document was read clearly.
• Medium — most of the document was read clearly.
• Low — the app had difficulty reading the document; treat the extracted fields with extra caution and check the original.

Confidence is supporting context, not the headline. The review always leads with which fields agree or disagree, with the confidence band available under Show details.

You can still approve an application whose certificate is flagged or needs review — the flag never takes the decision out of your hands. To make sure a flag isn't missed in a hurry, a short confirmation appears first, summarising the unresolved flags (for example, "This application has 2 unresolved certificate flag(s). Approve anyway?").

That confirmation is a deliberate speed-bump, not a wall. A flag means "look closer," not "deny" — once you've looked, approving is one click.

When you approve an application whose certificate is verified, B2B Onboard helps apply the buyer's tax treatment in Shopify as part of approval — there's no separate step. This requires the Auto tax exempt setting to be on (Settings → see the Settings Guide). You stay in control: review the result and adjust the customer's tax settings in Shopify whenever your own judgement differs.

For a US resale certificate, the exemption is applied state by state — only for the states the certificate covers. Orders shipped to a covered state are zero-rated; orders to any other state are still taxed normally. B2B Onboard reads the covered states from the certificate; if it can't determine a covered US state, it applies nothing and leaves the message for you to set the buyer's tax treatment manually. This state-by-state scoping applies on both surfaces: a customer record, and — for B2B (native company) buyers — the company location, where the covered-state exemptions are set directly on the location rather than a blanket tax-exempt flag.

If the certificate is flagged or needs review at the moment you approve, tax-exempt is withheld — the customer (and company, if applicable) is still created normally, but the buyer is not zero-rated yet. Withholding is intentional: tax exemption waits until the certificate clears so a discrepancy never silently turns off tax. Once you've resolved the flag and the certificate is verified, use the Retry tax exemption control on the application's detail page to apply it.

When a certificate lapses, its exemption is revoked automatically — but only for the states that certificate covered. Once a certificate passes its expiry, B2B Onboard returns the buyer to taxable in the states that certificate applied to and records the change on the application timeline. This is scoped, not account-wide: if the same buyer still has another valid certificate covering other states, those exemptions are left untouched. This automatic revocation runs on every plan — it is part of how state-scoped exemptions are kept accurate, and does not depend on the Pro-only expiry reminder emails. Treat it as a safeguard, not a substitute for your own review — you remain responsible for confirming each buyer's tax treatment is correct.

This applies to resale and tax-exemption certificates. Buyers with a verified EU/UK VAT number continue to receive the cross-border reverse-charge exemption as before. B2B Onboard helps apply exemptions and surfaces what it read — you decide the final tax treatment; it does not provide tax advice.

The first-time certificate flow starts with a registration form. Existing customers — who are already in Shopify and often have no storefront login — need a different entry point. The self-service portal is that entry point: a personal renewal link the customer can open in any browser, with no account required.

1. You copy the link. On an approved application's detail page (under Documents), click Issue renewal link. A personal, expiring link is generated for that customer; copy it and send it to them however you like (email, your own portal, etc.). You can issue a fresh link any time — issuing again replaces the old one.
2. The customer re-uploads — no login. Opening the link shows the customer their current certificate status and a single upload field. They choose a new PDF or image and submit. There's no password and no Shopify account involved.
3. It lands on the Certificate renewals page. Because a re-upload has no application behind it, it doesn't appear in the original application's Documents card. Instead it shows up on the new Certificate renewals page (in the app's main navigation), with the same AI verification outcome you see for first-time uploads, plus Accept and Reject controls.
4. Accepting refreshes tax-exempt status. When you Accept a renewal, the customer's tax-exempt status is refreshed automatically — on the company location for B2B buyers, or on the customer record otherwise. Reject records the decision and changes nothing about their tax status.

An early renewal never interrupts a valid exemption. A pending renewal is never applied automatically and never switches off an existing exemption. If a customer renews before their current certificate expires, they stay tax-exempt the whole time — submitting early is never penalised.

If a certificate is not renewed and lapses, its exemption is revoked automatically — scoped to the states that certificate covered (see Tax exemption on approval). The Certificate renewals page still flags the resulting exemption gap so you can follow up.

Instead of watching expiry dates yourself and issuing renewal links by hand, B2B Onboard can do it for you. As a certificate nears its expiry date, the app emails the customer their renewal link automatically — the same secure, personal link described above, opened in any browser with no login required — so a renewal can be uploaded before the current certificate lapses.

Each customer gets up to two automatic reminders: a heads-up about 30 days out, and a final reminder about 7 days out. Each reminder is sent at most once — the app tracks which reminders it has already sent for a certificate and won't repeat them. (If a certificate first comes into view inside the 7-day window, only the final reminder is sent.) Reminders go out before the expiry date; a certificate that has already lapsed isn't emailed automatically — it surfaces as an exemption gap on your Certificate renewals page instead.

The reminder points the customer at the self-service renewal page, and the re-upload is reviewed exactly like any other — it lands on your Certificate renewals page with the same AI verification outcome and Accept / Reject controls.

Reminders are a convenience to help you and your customers stay ahead of expiries — the reminder emails themselves don't renew anything. The reminder emails are Pro-only, but the underlying safeguard is not: whether or not a reminder was sent, an unrenewed certificate that lapses has its exemption automatically revoked on every plan, scoped to the states it covered (see Tax exemption on approval). You still approve every renewal, and you remain responsible for reviewing the result and for monitoring whether each certificate is current and valid.

The same tax-exemption status now also appears on the Company hub, so you can see a business's certificate standing right where you manage the company.

On a company's detail page, a Tax exemption card shows the current status, expiry, the AI verification read, and the certificate history — with a Manage button that opens the certificate action drawer for the matching customer.

The Companies list keeps a tax-exemption column that flags companies whose certificate needs attention. Cross-company triage — finding every business with an expired, expiring, or pending-review certificate — now lives on the Action required worklist (see below), so the Companies list itself no longer carries separate certificate-status tabs.

The Action required page in the navigation is your daily-driver worklist: it lists every business that needs attention, sorted worst-first (expired, then needs review, then expiring soon), with saved-view tabs (All / Expired / Needs review / Expiring soon). Clicking a row opens the certificate action drawer for that business — the same drawer that handles accept, remove an exemption, and issue or email renewal links. Acting on a certificate clears the item the next time the page loads — there is nothing to dismiss by hand.

External tax services. If we detect that Avalara AvaTax is active on your shop, the Action required page shows a warning at the top. Detection is best-effort and covers Avalara AvaTax only — other external tax engines (for example Vertex or Shopify Tax Platform partners) cannot be detected through any public Shopify API. If you use any external tax service, confirm it is configured to honour Shopify's tax-exemption settings: exemptions applied by this app may be overridden at checkout by an external engine that isn't set up to respect them. Review your tax service's exemption configuration so approved businesses are charged correctly.

To assist your review, uploaded certificates are scanned automatically using AI-assisted optical character recognition (OCR) and field extraction (Amazon Textract and Amazon Bedrock). The result is presented to you as decision-support only — it highlights possible discrepancies and flags documents that couldn't be read clearly.

This is not a solely automated decision: a person reviews every application and makes the final approval or rejection. Extracted data is stored alongside the application solely to support that review, and is subject to the same retention and deletion rules as the rest of the application data.

This includes renewals: when an existing customer re-uploads a certificate (Pro), it is scanned the same way, and the same disclosure, retention, and deletion rules apply.

For full details on automated processing, data handling, and sub-processors, see our Privacy Policy and Data Processing Agreement.

Certificate review runs as part of the application workflow — see the Applications Guide for how it fits into approving and rejecting applications.