Supplier certificate upload with no login
If you want suppliers to upload certificates without a portal account to create and a password to reset, Certly sends each supplier contact a single-use, expiring signed link by email. It opens straight onto an upload page, accepts one upload, and then stops working.
Why supplier portals go unused
The reason a supplier has not sent you their allergen declaration is rarely that they refuse. It is usually that you asked them to register.
The person on the other end is a quality contact at an ingredient house who serves dozens of customers, each with a different system. Choosing a password, confirming an email address, and then finding all of that again eleven months later, for a file they could attach to a reply in nine seconds, is a poor trade for them. So they attach it to a reply. It lands in your inbox on a Friday afternoon, gets dragged into a shared drive if you have time, and the spreadsheet row stays blank if you do not.
That is the gap most certificate chasing falls into. It is not a missing document, it is a document sitting in an email thread with nothing connecting it to the supplier record an auditor will ask about. Meanwhile the certificate you think you hold is the one you remember receiving, not the one on file.
Certly's answer is a link rather than a registration. The supplier receives it, opens it, uploads the file, and the link closes behind them. There is nothing to join and no credentials to issue or revoke later, because the link itself is the access and it works once.
How the single-use link works
- The link is signed for one supplier and one certificate type
Certly holds your suppliers with their contact details and the certificate types you require from each, such as allergen declaration, CoA or audit certificate. A link is signed against that specific supplier, so an upload can only land in one place.
- It goes out by email to the supplier contact
The link is sent to the contact email held on the supplier record. Certly's automated chase sequences for certificates approaching expiry or already lapsed carry the same one-click upload link, so the chase and the means of answering it are the same message. Before anything sends, you can read the exact chase template, subject line and body, in the chase settings.
- The supplier opens an upload page
The page is the upload form itself, reached straight from the link. Required fields such as certificate type and expiry date are validated on the server, and errors come back inline on the field rather than as a generic failure, so a mistyped date is fixable on the spot.
- One successful upload closes the link
On success the token is marked used. The same URL, forwarded to a colleague or clicked again the next week, no longer accepts an upload and returns a gone response instead. Links also carry their own expiry and stop working when it passes, whichever comes first.
- The certificate lands on the supplier record
The file is stored tied to that supplier and that certificate type, filed against the record an auditor asks about rather than left in a mail thread. It then appears in the single-screen status view across the four states Certly reports, current, expiring soon, expired and missing, and in the PDF export you hand an auditor.
What happens when a link is reused or out of date
| Situation | What Certly does | What the supplier sees |
|---|---|---|
| Valid link, not yet used | Accepts the upload and records the time it was used | The upload form, then a confirmation |
| Link already used once | Refuses the upload and returns 410 Gone | A clear message that the link has expired or already been used |
| Link past its expiry window | Refuses the upload and returns 410 Gone | The same expired or already used message |
| Link for a supplier that does not exist | Returns 404 Not Found | A readable not found message rather than an upload form |
What this changes for a QA team
One click between intention and arrival
The supplier's path from deciding to send you the CoA to the file being filed against their record is a click in an email they already have, with no onboarding call to arrange and nothing for them to remember a year later.
The chase ends at the upload, not in your inbox
Because the chase email carries the upload link, the reply path is the file itself. You stop being the manual step that moves a PDF out of a mail thread and into a supplier folder, and the send is logged so you can see what went out and to whom.
No standing upload address into your records
Each link is single-use and expires on its own, so a URL forwarded around a supplier's team, or left in a mailbox after someone leaves, is not a permanent door into your plant's certificate store.
A dead link says so
The supplier sees an explicit expired or already used message rather than a silent failure. That is the difference between them asking you for a fresh link and both of you assuming the certificate was sent.
Tested behaviour, not assumed behaviour
Token expiry and single-use enforcement are covered by integration tests: a valid unused token succeeds and is marked used, a used token is refused, an expired token is refused, and an unknown supplier returns not found.
What the link does not do
Certly tracks and reminds on certificate expiry. It does not verify certificate authenticity or guarantee regulatory compliance, and that is stated on the dashboard and on the PDF export you hand an auditor. A file arriving through a single-use link is a file the supplier sent, dated and filed against the right record. Reading it, judging it and accepting it into your approved supplier programme remains your team's work.
The link also does not replace you. Your QA team can upload a certificate manually at any time, tied to the same supplier and certificate type, for the cases that will always exist: the paper copy handed over at the gate, the certificate that arrives on a courier's clipboard, the supplier contact who prefers to email you and always will.
On the personal data in these documents
Supplier certificates carry named individuals: signatories, auditors, quality managers. Certly stores supplier company names, contact names and contact email addresses so the links can be sent to the right person in the first place, along with the documents themselves and their issue and expiry dates.
There is a right-to-erasure action on a supplier's page that removes a contact's name and email while leaving the certificate records intact, behind a confirmation that spells out what goes and what stays. Certly runs on Amazon Web Services, each plant is a single tenant, and every supplier and certificate query is scoped to your plant.
Where Certly is today
Certly is not open yet. The single-use upload link is built, its expiry and single-use behaviour are covered by tests, and we are taking waitlist places from QA managers at mid-market food plants who are tired of being the postal service for their own supplier certificates.
When it opens, Starter covers a single plant tracking up to 50 suppliers at $3,228 a year, Professional covers up to 200 suppliers at $5,388 a year, and both start with a 14-day free trial. Multi-site, for groups with two or more sites, is priced on request.
Questions
Do suppliers need an account or a login to upload a certificate?
No. The upload happens through a single-use, expiring signed link sent to the supplier contact by email, which opens straight onto the upload form. Only your own QA team signs in to Certly, with an email address and password.
How long does an upload link stay valid?
Each link carries an expiry and stops accepting uploads once it passes. It also closes after one successful upload, whichever comes first. A supplier who clicks an expired or already used link sees a message telling them so rather than a broken page.
Can one link be used for several certificates?
No. A link is signed for one supplier and is marked used as soon as an upload succeeds. If a supplier owes you both an allergen declaration and a CoA, or needs a second attempt after a mistake, they need a fresh link.
What if the supplier loses the link or it expires before they use it?
Send another. The automated chase sequence for certificates approaching expiry or already lapsed carries a one-click upload link with each send, and you can trigger a chase immediately from the dashboard row or the supplier's page when someone asks for a new one.
Can my own team still upload certificates directly?
Yes. Your QA team can upload and store a certificate manually at any time, tied to a supplier and a certificate type, which is the path for paper copies and for suppliers who will only ever email you.
What happens to a supplier contact's details if they ask to be removed?
There is a right-to-erasure action on the supplier's page that deletes the contact name and email address, behind a confirmation explaining that the certificate records themselves remain on file.