What a supplier actually receives when Certly asks for a certificate
Suppliers send their certificates when asking costs them nothing: a plain email from an address they already recognise, naming the document, carrying one link that opens an upload page with no account to create. This page answers the questions QA managers ask about that experience, from the supplier's side of it.
Why the certificate does not arrive, and what changes that
Most suppliers are not withholding the document. The certificate sits in a folder on somebody's desktop at a forty-person ingredient business, and your request arrived as the fourth message in a forwarded thread with no clear ask, no deadline and no obvious place to put the file. Every extra step you add, a portal account, a password, a form with fields they do not understand, is another week of silence before your audit.
Certly is built to take those steps away. A chase email goes to the supplier contact recorded against that supplier, naming the certificate and the site that needs it, and carrying one link. The link opens an upload page with no sign-in.
The message is built to leave from a sending account you connect yourself, held as a from address, mail server and sign-in name, with the mailbox password or API key encrypted before it is stored. That is deliberate. A request that arrives from the address a supplier already corresponds with reads as your plant asking rather than as a vendor tool, and that is most of what keeps it out of a spam folder. A site that has not connected its own mailbox has its chase and upload-link emails delivered through Amazon SES instead.
When the automated sequence is not the right route, because the contact has changed hands or the relationship runs through your buyer, there are two manual routes. Each certificate slot on the supplier's own page carries a copy upload link action, so you can paste the same link into an email you write yourself, and each supplier row on the dashboard and on the supplier's page carries a chase now button that sends the chase email immediately. What follows is what all of that looks like in practice.
Questions
What does the supplier actually receive when Certly asks for a certificate?
One email, sent to the contact you recorded against that supplier, from the sending account your site has connected, written as a plain transactional message rather than a branded announcement. The subject and body name the certificate type and your site, say which document is due, and carry a single upload link with no URL shortener in front of it. There is nothing to download, no form to complete before the file goes across, and nowhere that asks the supplier to sign in or hand over credentials, which is the answer to give a contact who asks whether the message is genuine. The settings screen holds a read-only preview of that exact subject line and body, so you can read the message a supplier will read before any of them read it.
Does the supplier need an account, and what file can they send?
No account and no password. The link opens a self-service upload page with no login at all, where the supplier picks the file and sends it back on that one page, and Certly files it against the right supplier and certificate type. Certificate documents go in as PDF, PNG or JPEG, with their issue and expiry dates, which is what the status on your dashboard is computed from. Files over 4 MB are turned away with a plain message asking for a compressed scan, so if a supplier's multi-page audit certificate is a heavyweight scan it is worth telling them to compress or split it before they try.
How long is the upload link good for, and what if a supplier clicks it twice?
Upload links expire on their own and each one works once. A valid, unused link opens the upload page and records the file against the right supplier and certificate type. A link that has already been used, or one that has passed its expiry, no longer accepts an upload, and the page says plainly that the link has expired or has already been used rather than failing silently. That behaviour is covered by end-to-end tests over the unused, reused, expired and unknown cases, because a dead link that looks alive is worse than no link at all.
Can I send the upload link myself instead of waiting for a chase?
Yes, and for some suppliers that is the faster route. On the supplier's own page, each certificate slot carries a copy upload link action, and so does each entry in the chase log, so you can take the link and paste it into a reply in a thread the supplier is already reading, or into a message to the buyer who owns the relationship. Two practical notes: the action lives on the supplier's page rather than on the dashboard row, and on a narrow phone screen it renders as a compact icon with no label, so it is easier to find on a desktop. There is also a chase now button on each supplier row on the dashboard and on the supplier's page, which sends a one-off chase email straight away and logs it like any other send. The sibling page on sending a supplier an upload link yourself walks through when to reach for each one.
What happens when a supplier ignores the first email?
Certly runs automated chase sequences to the supplier contact for certificates approaching expiry and for ones that have already lapsed, each send carrying the one-click upload link. The timing follows the expiry alert thresholds you set, at 90, 60 and 30 days before the expiry date, so the first polite nudge goes out while there is still time for the supplier's certification body to issue a renewal. The sequence counts back from a recorded expiry date, so a document that carries no printed expiry date, the normal case for an allergen declaration, is one you drive yourself with a manual chase or a copied upload link; the sibling glossary entry on the allergen declaration explains why those documents so often arrive undated. Every send is logged against the supplier, and you can add a manual chase on top of the sequence at any point from the row.
How do I know the email reached a real person?
The chase log on the supplier's page shows every send with its own status, sent, failed or opened, rather than assuming the message landed, and records the recipient and the time it went out. A failed send gets a distinct badge and a resend action next to it, so a bounce is visible instead of silent. That matters because supplier contacts churn, and a quality manager who left in March takes your reminders with her unless you can see delivery failing. Treat a run of failed chases as a prompt to get a current contact from your buyer, or to copy the upload link from the certificate slot and send it through a channel you know works, not as a supplier refusing to answer.
What about a supplier who has never sent the document at all?
That slot shows as missing on the dashboard, alongside current, expiring soon and expired, because the required certificate types you set against a supplier define what ought to be on file. The automated sequence is keyed to expiry dates, so a document that has never arrived has no date to count back from and will not be picked up by the 90, 60 and 30 day thresholds on its own. For those rows you drive it: copy the upload link from the slot on the supplier's page and send it with the first purchase order, so the ask reads as a first request rather than a renewal reminder. The sibling guide on onboarding a new supplier covers getting documents in before the first delivery, which is where that work belongs.
Does Certly check the certificate is genuine when it arrives?
No, and the product says so on the dashboard and on the PDF export. Certly tracks certificate status and reminds the right person when a document is due; it does not verify certificate authenticity and it does not guarantee regulatory compliance. Reviewing the scope, the issuing body and the content of what a supplier sends remains your job, exactly as it is today. What changes is that the document is in front of you with a recorded expiry date, instead of missing from a shared drive on the morning of an unannounced audit.