Supplier document management for food safety consultants
Supplier document management on a consulting engagement is mostly collection and expiry: allergen declarations, certificates of analysis and third party audit certificates, gathered against the client's approved supplier list and kept in date. Certly is built to run that collection, the chasing that follows and the record of what was held when, so the file keeps moving between your visits.
The document problem at the start of an engagement
Supplier document management on an engagement comes down to three questions: what the plant is required to hold against each supplier, what it actually holds, and what has gone out of date. The questionnaires, the scoring and the approval decision are judgement, yours and the QA team's. The paperwork underneath them is collection and expiry, and that is the part a tool can carry.
The situations below are composite and illustrative rather than named clients, but the shapes will be familiar. A plant keeps its approved supplier list in a spreadsheet with an expiry column nobody has touched since the last audit. A plant keeps a shared drive folder per supplier holding three versions of the same allergen declaration and no reliable way to tell which is current. A plant has a QA manager genuinely on top of it, and a technologist on leave who was the only person chasing suppliers for their certs.
So before advice comes evidence. You need to know what is on file, what is out of date and what was never collected at all, and that is usually an afternoon with a folder tree and a supplier list. The answer tends to have the same shape: the third party audit certificates are mostly there, the CoAs are patchy, two suppliers have gone quiet since a contact changed, and a handful of declarations carry no printed expiry at all.
The cost of missing one lands on the client first and on you second. An out of date certificate sitting on file is the kind of thing that gets written up, the corrective action then has to be closed out with evidence, and if the visit was unannounced there was no week of preparation in which to catch it. Whether the plant is certified to BRCGS, SQF or FSSC 22000, the finding reads the same way, and you are the person who was supposed to have caught it.
What you want from software at that point is narrow. Not a compliance platform, and not a new system of record for everything the plant does, but document control for one category of paperwork: a current list of which documents each supplier owes, a date on every document held, a chase that goes out without you writing it, and a trail you can read back when an auditor asks.
How the document set gets built and kept
- Write the required document set against each supplier
Add, edit and list suppliers with their contact details and the required certificate types: allergen declaration, CoA, third party audit certificate. The gap between what is required and what is held becomes explicit rather than remembered.
- Bring in what the plant already has
The QA team uploads existing certificates manually, each one tied to a supplier and a certificate type, with the date on the form and its expiry date. The folder tree turns into a list of documents with dates attached, which is the artefact your gap analysis needed in the first place.
- Give the documents with no printed expiry a renewal period
Allergen declarations and vendor forms often carry no expiry date on the page. Each certificate type can hold a renewal period for that plant, and an upload records the issue date and derives the due date from it, so a declaration signed three years ago is not sitting in the file with a blank date beside it.
- Ask suppliers for the documents that are missing
Suppliers upload through a single use, expiring signed email link with no login. The contact at a supplier who deals with forty customers does not need an account, a password or a portal invitation to send one PDF back.
- Set the warning window that suits this supply base
Expiry tracking with configurable alert thresholds at 90, 60 and 30 days before expiry, computed by a scheduled job. A plant whose suppliers are slow to respond can lean on the 90 day warning; a plant with a responsive base can run tighter.
- Hand the follow up to the chase sequence
Automated email chase sequences go to supplier contacts for certificates approaching expiry or already lapsed, each carrying a one click upload link, and each send is logged. The chasing continues in the weeks between your visits.
- Pull the status view before the audit
A single screen shows certificate status per supplier: current, expiring soon, expired or missing. That dashboard exports to PDF for auditor review, so the review conversation starts from a list rather than a folder.
The document types Certly is built around
| Document | How it gets in | What Certly holds against it |
|---|---|---|
| Allergen declaration | Uploaded by the QA team, or by the supplier through a single use expiring link | Supplier, certificate type, the issue date on the form, a due date derived from the plant's renewal period for that type when no expiry is printed, status, superseded versions and the log of chases se |
| Certificate of analysis (CoA) | Same two routes, recorded against a specific supplier and certificate type | Issue and expiry dates, with alerts at 90, 60 and 30 days before it lapses |
| Third party audit certificate | Uploaded directly as PDF, PNG or JPEG, or requested from the supplier contact by chase email | Current, expiring soon, expired or missing on the status dashboard and PDF |
Keeping the file current after the first pass
Document collection is easy to start and hard to sustain, and a consultant feels that more sharply than a QA manager does, because you are not in the building most weeks. Five things carry the work in between.
Dates that are checked without anyone remembering to
Expiry tracking runs on a scheduled job against the thresholds set for that plant, so a certificate approaching its date raises an alert at 90, 60 or 30 days rather than at the moment someone opens the folder. The thresholds are configurable, which matters when a plant buys from a handful of large suppliers with predictable renewal cycles and another buys from small producers who need a month of notice.
A due date for the documents that do not print one
The expiry time varies by document type, and the awkward cases are the ones with nothing printed: allergen declarations, vendor questionnaires, continuing guarantees. A renewal period can be set per certificate type for the plant, and an upload records the date on the form, so the due date is derived rather than left blank and the document joins the same alert and chase cycle as everything else. That is the row that otherwise sits as missing or as current forever, and it is the one an auditor asks to see refreshed.
A chase history you can read back
Every chase email is logged with the recipient, the time it was sent, the delivery result and whether it was opened, so what you report to the client is what was actually delivered rather than what you assume went out. When a supplier says nobody asked them, there is a record of what was asked, of which contact, and when. That is the part of the engagement that used to live in your sent items.
The version that was valid last March
Nothing is thrown away by a renewal: an uploaded certificate that replaces an earlier one is kept alongside it, with its issue and expiry dates, and expired certificates and chase history are kept while the account is open. That is the trail an auditor asks for when the question is not what is current but what was on file on a particular date.
A defined way to remove contact data
Supplier documents and contact records carry named individuals, so removal needs to be a function rather than a favour. A supplier contact's name and email can be erased on their own from that supplier's page, behind a confirmation that spells out what goes, the contact name and email, and what stays, the certificate records. Deleting the whole account from Settings, Site details removes suppliers, certificate documents, chase history, settings and sign-in details at once, and the same screen downloads a JSON file of your data first.
Where accounts and plans sit
Suppliers, certificates and chase logs are read inside the scope of the plant they belong to, with plant scoped isolation applied on every query. You sign in with email and password. Starter covers one plant and up to 50 suppliers at $3,228 a year, which is 269 dollars a month, 10 percent off the 299 dollar monthly rate for paying up front; Professional covers one plant and up to 200 suppliers at $5,388 a year, or 449 a month on the same basis. Starter and Professional each carry a 14 day free trial. Multi-site is $10,788 a year, 899 a month on the same prepay basis, for groups running up to 5 sites under one agreement with no supplier cap, and it does not carry a trial. Certly is hosted on Amazon Web Services, and today there is no choice of hosting region, no single sign-on or two factor authentication, and no standard data processing agreement ready to countersign, which is worth knowing before you recommend it into a client's supplier onboarding paperwork. The pricing page carries every figure; if the work spans a group of sites rather than one plant, the page on tracking certificates across more than one plant and the page for consultants managing several client plants cover that ground, and this page stays with the single engagement.
What this changes about the document work
The opening gap analysis becomes a screen rather than an afternoon
Once the supplier list and required certificate types are in, the status view answers the first question of an engagement in one place: current, expiring soon, expired or missing, per supplier.
Collection continues between your visits
Chase emails go out on that plant's thresholds whether or not you are on site that month, and each send records its delivery result, so you can see what was asked of which supplier, when, and whether it arrived.
Declarations with no printed date still get a date
A renewal period per certificate type, plus the issue date captured at upload, gives the undated documents a derived due date, so the allergen statement an auditor asks to see refreshed is tracked like everything else.
Suppliers are not asked to adopt anything
A single use, expiring link and one upload is the whole ask. You are not negotiating portal accounts with a supplier's sales contact on your client's behalf.
The history survives the renewal
A replaced certificate is kept beside the one that replaced it, so a question about the declaration that was valid on a past date has an answer in the record rather than in someone's inbox.
One document to bring into the audit room
The PDF export of the status dashboard gives the auditor a starting list of suppliers and document states, with Certly's disclaimer printed on it so its role is not overstated.
A clean answer on personal data
A supplier contact's name and email can be erased on their own from that supplier's page, with the certificate records left in place, so the data question in a supplier conversation has a specific answer.
Questions
Which supplier documents can I track?
Certificates held against a supplier and a certificate type, with the required types set per supplier. Allergen declarations, CoAs and third party audit certificates are the types Certly is built around, uploaded as PDF, PNG or JPEG, and each one carries the issue date from the form, an expiry or derived due date, a status and a chase history.
What about an allergen declaration with no expiry date printed on it?
A renewal period can be set per certificate type for the plant, and the upload records the date on the form, so the due date is derived from the issue date rather than left blank. The row then moves through the same 90, 60 and 30 day alerts and the same chase sequence as a dated certificate.
Do my client's suppliers need accounts to send documents?
No. A supplier receives a single use, expiring signed email link, opens it, uploads the certificate and is done. There is no login, no password and no portal registration for the supplier contact.
Can the alert thresholds be set to suit the supply base?
Yes. Alert thresholds are configurable at 90, 60 and 30 days before expiry, computed by a scheduled job, so a plant whose suppliers need a month of notice can run on the 90 day warning while a plant with a responsive base runs tighter. Renewal periods are set per certificate type for the plant alongside them.
Does a green status mean the certificate has been verified?
No. Certly tracks expiry dates and reminds the right contact about them. A persistent disclaimer on the dashboard and on the PDF export states that the platform does not verify certificate authenticity and does not guarantee regulatory compliance, so the status view is a record of what is on file and when it lapses, not an attestation.
What does it cost, and who is billed?
Starter is $3,228 a year for one plant and up to 50 suppliers, Professional is $5,388 a year for one plant and up to 200, and Multi-site is $10,788 a year for up to 5 sites under one agreement with no supplier cap. All three are billed annually, which is 10 percent off the equivalent monthly rate. Starter and Professional carry a 14 day free trial; Multi-site does not. The pricing page carries the detail; whether the consultancy or the plant holds the subscription is your commercial decision.
If a supplier sends a renewal, do I lose the old certificate?
No. The version that was replaced is kept with its issue and expiry dates, along with expired certificates and the chase history, for as long as the account is open. That is the record an auditor asks for when the question is what was valid on a given date.
Where does the data sit, and what happens to supplier contacts afterwards?
Certly is hosted on Amazon Web Services, with uploaded certificate documents held in the product's own database and each plant's data scoped to that plant on every query. A supplier contact's name and email can be erased on their own from the supplier's page, with the certificate records left in place, and deleting the account removes suppliers, documents, chase history and sign-in details at once. There is no choice of hosting region today, and no data processing agreement ready to countersign.