What Connecticut and Federal Inspectors Are Looking For in a Cold Brew Production Facility

Cold brew coffee sits in an unusual regulatory position that trips up many small producers. It looks simple: coffee grounds, cold water, time. But from a food safety standpoint, cold brew is classified as a low-acid beverage with a finished pH typically above 4.6 and a water activity above 0.85. That combination puts it in the same risk category as other hermetically sealed low-acid products, where the absence of heat treatment and the anaerobic environment inside a sealed container create conditions that can support Clostridium botulinum if the product is not properly controlled and refrigerated.

In Connecticut, food processors producing cold brew for wholesale are licensed and regulated by the Connecticut Department of Consumer Protection (DCP), Food and Standards Division. This is the primary state licensing authority for non-meat food manufacturing operations. Separately, the Connecticut Department of Public Health oversees food service establishments, which matters for cafes and restaurants producing cold brew for on-premises service. If you are bottling, canning, kegging, or otherwise packaging cold brew for wholesale distribution to retailers, coffee shops, or restaurants, DCP is your state regulator.

On top of that, the FDA’s Food Safety Modernization Act (FSMA) applies at the federal level to most cold brew producers with annual sales above the very small business threshold. FSMA requires a written Food Safety Plan that identifies hazards, establishes preventive controls, and documents monitoring, corrective actions, and verification procedures. When a DCP inspector or an FDA investigator audits a Connecticut cold brew facility, they are looking at the same core question: does this operation have documented controls for the biological, chemical, and physical hazards inherent to cold brew production, and is it actually following them?

Why Cold Brew Triggers a More Complex Compliance Path Than Hot Coffee Service

The central food safety concern with cold brew is one that most producers understand in concept but underestimate in practice: Clostridium botulinum. Cold brew is typically a low-acid food. Unlike hot coffee, which is brewed at temperatures that destroy vegetative pathogens, cold brew is produced at ambient or refrigerated temperatures over extended steep times, often 12 to 24 hours. No thermal kill step occurs during brewing. If the finished product is then packaged in a hermetically sealed container, the anaerobic environment inside that sealed bottle or can is exactly the condition under which C. botulinum can produce toxin, provided the product is also not kept adequately cold.

This is why refrigeration is not just a quality preference for cold brew: it is a primary safety control. The FDA’s Preventive Controls rule under FSMA, which governs most packaged cold brew producers, treats temperature control for sealed low-acid beverages as a process preventive control or a supply chain control, depending on your distribution model. Your Food Safety Plan must document how C. botulinum is controlled throughout the product’s entire cold chain, from your production facility through distribution to the end consumer.

Connecticut producers selling wholesale also face an additional federal registration requirement. Any processor engaging in other than direct sales to consumers must register with the FDA under the Bioterrorism Act. Wholesale producers of low-acid or acidified packaged foods must also register with FDA under 21 CFR Part 108. Both registrations are free, but they are legal prerequisites to wholesale distribution, and Connecticut DCP inspectors verify that registrations are in place.

The distinction between retail-only and wholesale production also affects which Connecticut license you need. On-site production served directly to customers at a coffee shop or cafe falls under a local food service establishment license, issued and inspected by your local health department or district. The moment cold brew leaves your facility for sale to another business, a DCP Food Manufacturing Establishment (FME) license is required. Many Connecticut cold brew producers have started in a cafe context and grown into wholesale without recognizing that the licensing category changes entirely.

The Critical Control Points That Connecticut Cold Brew Producers Must Address in Their Food Safety Plan

A FSMA-compliant Food Safety Plan for cold brew is structured around process preventive controls rather than the classic HACCP format, but the practical monitoring requirements are similar. Here are the hazards and controls your plan must address, with the specific parameters inspectors and FDA investigators look for.

Refrigeration temperature throughout the cold chain: This is the primary process control for C. botulinum in sealed low-acid cold brew. The finished product must be maintained at or below 41 degrees Fahrenheit from packaging through distribution and retail. Your Food Safety Plan must specify the critical limit, define how temperature is monitored at each stage, and describe what happens when a cold chain deviation is detected. This includes your own storage, your distribution vehicles, and the handoff point to retail accounts. A temperature log or continuous monitoring record is the documentation baseline. Cold brew that has been temperature-abused and is then consumed presents a genuine public health risk, and a missing temperature log is treated as evidence that the control was not operating.

pH monitoring: Cold brew’s pH is typically in the range of 4.8 to 5.1, well above the 4.6 threshold at which C. botulinum becomes a concern. Your Food Safety Plan should document the pH range of your finished product and explain why it does not fall below 4.6, since dropping below that threshold would change your regulatory classification from a low-acid food to an acidified food, triggering a different set of federal requirements under 21 CFR Part 114. If you add any acidic ingredients, flavors, or concentrates that could affect the finished pH, you need to verify the effect on your pH profile and adjust your food safety controls accordingly.

Brew water quality: Water is your primary ingredient by volume. Your Food Safety Plan must document that you are using a potable water source, and if you are using a private well at your facility, Connecticut DCP requires annual water analysis results to be maintained on file and presented on request. Municipal water sources should be documented, but private well water carries additional testing obligations that cannot be deferred.

Sanitation of brew vessels, lines, and filling equipment: Mold, yeast, and environmental bacterial contamination are the most likely biological hazards for cold brew under normal production conditions. Your sanitation procedures for all equipment that contacts the product, brew vessels, filters, lines, valves, filling heads, and container sealing equipment, must be documented as a prerequisite program or sanitation preventive control. Verification records, such as ATP testing or visual inspection logs, should exist for each production cycle and be retained as part of your Food Safety Plan records.

Incoming coffee supply chain: Roasted coffee can carry chemical hazards including pesticide residues and mycotoxins, particularly if green coffee sourcing is not controlled. Your Food Safety Plan should include a supply chain program that documents your coffee suppliers as approved sources and, depending on your risk assessment, may require supplier verification activities such as certificates of analysis or audit results.

Maintaining Compliance Between DCP Inspections and Under FSMA’s Ongoing Requirements

FSMA’s Preventive Controls rule requires that Food Safety Plans be reviewed and reanalyzed at least every three years, and whenever a significant change occurs, including a new product formulation, a new packaging format, a new distribution channel, or a change in suppliers. Launching a new SKU without reanalyzing your Food Safety Plan is a common compliance gap as small cold brew operations grow.

FSMA also requires that a Preventive Controls Qualified Individual (PCQI) either develop your Food Safety Plan or oversee its development. A PCQI is someone who has successfully completed training in accordance with a standardized curriculum recognized by FDA, such as the FSPCA Preventive Controls for Human Food course. This person must sign off on your Food Safety Plan. Their name, training credentials, and the date of plan review should be documented as part of the plan file. If the person who developed your original plan has left the company, the plan may technically be unassigned, which is a compliance issue.

Record retention under FSMA is a minimum of two years for most Food Safety Plan records, including monitoring logs, corrective action records, and verification activities. For cold brew specifically, temperature records, sanitation logs, and batch records should be organized so that any specific production lot can be traced through your system, from incoming coffee lot to finished packaged batch to distribution destination. This is the foundation of an effective recall procedure, and it is one of the first things an FDA investigator requests during a facility inspection.

The Documentation Gaps That Lead to FDA Warning Letters and DCP Violations

Cold brew producers in Connecticut and nationally have faced FDA warning letters and import alerts for documentation failures more than for actual product contamination events. The pattern is consistent: the product was probably safe, but the paperwork was not in place to demonstrate it.

Specific failure patterns to know: Food Safety Plans that were drafted at startup and never updated after the business added new SKUs, seasonal variants, or changed packaging from bottles to cans. Monitoring records for refrigeration that exist for recent weeks but cannot be produced for prior months, suggesting they were not actually kept contemporaneously. Sanitation logs that list cleaning procedures without verification records showing the equipment was actually cleaned before that production run. Supplier documentation for coffee that consists of informal email conversations rather than signed supplier verification agreements or certificates of analysis.

A specific issue for growing Connecticut cold brew operations: the transition from direct-to-consumer sales to wholesale. This shift changes both the Connecticut licensing requirement (from food service to DCP FME license) and the FSMA applicability, since operations above the very small business annual sales threshold become subject to the full Preventive Controls rule. Many producers have crossed that threshold without updating their compliance posture, operating under a food service establishment framework when they are legally required to hold a food manufacturing license and maintain a FSMA-compliant Food Safety Plan.

The inspection you just passed? It will happen again.

Connecticut operations are re-inspected regularly and every batch, temperature log, and corrective action needs to be documented every time. HACCPEasy Platform gives your team a digital compliance system so the next inspector visit is a non-event.

✓ Operators log batches, temps, and corrective actions in real time
✓ Require photo evidence of pH readings, equipment checks, or any critical step
✓ If-Then logic flags deviations and locks the workflow until resolved
✓ One tap exports your full 180-day audit history when an inspector walks in

Start your 30-day free trial — no credit card required

Bottom Line

Connecticut cold brew producers selling wholesale need a Food Manufacturing Establishment license from the Connecticut Department of Consumer Protection, FDA facility registration, and an FSMA-compliant Food Safety Plan developed or overseen by a Preventive Controls Qualified Individual. The primary safety hazard is C. botulinum in sealed low-acid product, and refrigeration is your main control. Documenting that cold chain from your production floor through to your wholesale accounts, batch by batch, is the operational foundation of compliance. Producers who make the documentation habit a non-negotiable part of every production run are the ones who move through DCP and FDA inspections without disruption.

FAQ

Do I need a license to sell cold brew coffee wholesale in Connecticut? Yes. If you are packaging cold brew for wholesale distribution to retailers, restaurants, or coffee shops, you need a Food Manufacturing Establishment (FME) license from the Connecticut Department of Consumer Protection. You also need to register as a food facility with the FDA. Producing and serving cold brew directly to customers on-premises at a cafe is covered by a food service establishment license from your local health department, but any wholesale activity requires the DCP manufacturing license in addition.
Does cold brew coffee need a HACCP plan in Connecticut? If you are a wholesale manufacturer subject to FDA’s FSMA Preventive Controls rule, you are required to have a written Food Safety Plan, which is FSMA’s equivalent of a HACCP plan. It must include a hazard analysis, documented preventive controls, monitoring procedures, corrective action protocols, and verification records. A PCQI must develop or oversee the plan. Smaller operations below the very small business annual sales threshold have modified requirements, but refrigeration controls and basic GMP documentation still apply.
What is the biggest food safety risk with cold brew coffee? Clostridium botulinum is the primary concern for hermetically sealed cold brew. Cold brew is a low-acid beverage with a pH above 4.6 and a water activity above 0.85. When packaged in a sealed container without a thermal kill step, the anaerobic environment can support C. botulinum toxin production if the product is not kept adequately refrigerated. Maintaining an unbroken cold chain at or below 41 degrees Fahrenheit from packaging through to the consumer is the primary control, and it must be documented.
What happens if I add flavor syrups or other ingredients to my cold brew before bottling? Any ingredient addition that could affect the pH, water activity, or microbial load of your finished product must be assessed as part of your Food Safety Plan’s hazard analysis. If an acidic flavoring drops your finished pH below 4.6, your product may shift from a low-acid food to an acidified food category, triggering different FDA registration and processing requirements under 21 CFR Part 114. You should reanalyze your Food Safety Plan whenever you change your formulation and consult with your PCQI before launching a new flavor variant.

Connecticut Cold Brew Coffee HACCP: What the DCP and FDA Expect From Your Operation

Table of Contents