Supplier document management for food plants

Most mid-market plants already store supplier documents. They are in a folder tree on a shared drive, in the QA inbox where they arrived, in a downloads folder on one laptop, and in a spreadsheet that claims to index all of it. Storage is not the problem. Knowing which file is the current one, and for which supplier, and against which requirement, is the problem.

The symptoms are familiar. Two allergen declarations for the same supplier, one named with a version suffix and one without, and no reliable way to tell which came second. A CoA saved under a batch number instead of a supplier name. An audit certificate whose expiry date exists only inside the PDF and inside the head of the person who filed it. A supplier with three certificate types required and two on file, where the gap is visible only to whoever remembers the requirement.

That is also where an audit goes wrong. Nobody raises a non-conformance because your folder structure is untidy. They raise it because the document on file is out of date, or because the requirement you said applied to that supplier has nothing behind it, or because the evidence could not be produced while the auditor waited. The question that catches teams out is plain: show me the current allergen declaration for this supplier, and tell me when it expires, asked about a supplier nobody has thought about in nine months.

Certly's answer is narrow and deliberate. Every certificate is stored as a record, so the file, the supplier it came from, the certificate type it satisfies, and the dates it was issued and stops being valid are fields on one record rather than four things somebody has to remember.

Certly keeps a supplier database. You add a supplier with its contact details and you set the certificate types you require from that supplier, for example an allergen declaration, a certificate of analysis, and an audit certificate. You can edit and list those suppliers as the approved supplier picture changes.

When your QA team uploads a certificate, it is stored against one supplier and one certificate type, as a PDF, PNG or JPEG, with its issue date and expiry date recorded as dates. That is the whole idea. The document is no longer found by remembering where it was filed. It is found on the record of the supplier it came from, under the requirement it satisfies.

Each supplier and certificate type has one current document, the one your team has accepted. When next year's audit certificate arrives it is uploaded into that same slot with its own issue and expiry dates, and the status is computed from the dates you entered. There is one place to look for the allergen declaration from that supplier, rather than three files with similar names and a judgement call about which of them is in force.

Documents with no printed expiry

Not every certificate states when it stops being valid. Allergen declarations and vendor questionnaires often carry only the date they were signed, and plants treat them as valid for a fixed period of their own choosing, commonly a year or three. Certly is built for that case: the issue date is recorded on upload, and your plant can set a renewal period per certificate type, so the due date follows from the document's own date rather than from a note in a spreadsheet that only one person understands.

Uploads are done manually by the QA team, which is the honest description of how most plants work today: the document arrives by email, somebody looks at it, and somebody files it. Certly does not change who decides a document is acceptable. It changes what happens to the document after that decision, so that months later a colleague can see which supplier sent it and which requirement it was filed against. Suppliers can also send a document in themselves through a single-use, expiring link with no account to create, which is covered on the supplier upload page in this section.

What the record then makes possible is the rest of this pillar: a single-screen status view per supplier, and alert thresholds at 90, 60 and 30 days before expiry. Both have their own pages. This one is about the storage underneath them, because a status is only as good as the field it is computed from.

Certificate documents are held in the product's own Postgres database on Amazon Web Services, not in a shared file store, alongside supplier company names, contact names and contact email addresses, and the issue and expiry dates you record. Records are kept while your account is open, expired certificates and chase history included, because that trail is what an auditor asks for.

You can take it all back out and you can delete it. Account deletion sits in Settings, under Site details, confirmed with your email address, and it removes your sites, suppliers, certificate documents, chase history, settings and sign-in details at once, cancelling any live subscription. The same screen downloads a JSON file of your data first. A single supplier contact's name and email can be erased on their own, without touching the certificate records.

Certly is single-tenant per plant, and every supplier and certificate query is scoped to the authenticated user's plant, so your plant's supplier documents are read only by people signed in to your plant. People sign in with an email address and a password. Beyond Amazon Web Services, which hosts the application and its database and sends chase and upload-link email through Amazon SES for a site that has not connected its own sending account, Stripe handles subscriptions and card payments, and Resend delivers email for a site that connects a Resend account instead.

It is worth being plain about what is not in place yet, because a QA manager will be asked. There is no independent security audit or certification such as SOC 2 or ISO 27001, no single sign-on or two-factor authentication, no standard data processing agreement ready to countersign, no published backup and disaster-recovery schedule, and no choice of data residency region. If any of those is a condition of your approval process, it is better to know now than after a trial.