Collecting a certificate of analysis from every ingredient supplier
Certly is CoA management software for the QA manager at a single food plant, built to record which suppliers owe a certificate of analysis, store the documents they send, and chase the ones that have lapsed. It is made for the plant with fifty to two hundred ingredient suppliers and no document controller, where chasing certs is one job among twenty.
The week before the audit, you are chasing certs
If you searched for CoA management software, the job behind the search is usually this one. Every ingredient supplier on the approved supplier list owes you a certificate of analysis, and for most of them it renews on a cycle you do not control. The work is remembering which ones, knowing when, and getting a named person at the supplier to actually send the document.
In practice that means a spreadsheet tab with expiry dates in it, a folder on the shared drive, and a sweep through both when the audit date lands in the diary. You open each PDF to see whether it is the current one. You find three CoAs that lapsed in March. You email the supplier contact who has since left the business, get a bounce, track down the new contact, email again, and wait.
An out-of-date certificate on file is a documentation finding rather than a product event, but it still has to be closed out, and the corrective action costs a morning you had not planned for. The harder version is the unannounced audit, where there is no sweep week at all and whatever the folder says on the day is the answer.
The job to be done is narrow: keep a current CoA on file for every supplier that owes one, and know on any given morning which ones are not.
What CoA management software has to do in a mid-market plant
Searches for this land on two kinds of product. One is the enterprise supplier platform, built around specification management, ingredient data and supplier scorecards, bought on a quote and configured over months. The other is a general document expiry reminder that does not know what a supplier is, so you spend an afternoon mapping your plant onto its fields.
Certly is deliberately the narrow thing between them. It covers certificate collection and expiry for one plant, and it is built on three assumptions about how this work actually goes.
- The document arrives from the supplier, not from you. So the supplier needs the easiest possible route to send it, which is not an account on your system.
- The chase is the work, not the filing. Storing a PDF is trivial. Getting the renewal out of a busy supplier quality contact in week three is the part that eats the morning.
- An auditor wants the state of the supplier base on one screen, not a guided tour of your folder tree.
It is worth being plain about the other side of that. Certly does not read the figures inside a CoA, compare them against your raw material specification, or tell you a result is out of spec. It records the document, its type, its dates and its status, and it moves the chase forward.
How the CoA collection workflow runs
- Build the supplier list and say who owes a CoA
Add each supplier with its contact details and mark the certificate types it has to provide: certificate of analysis, allergen declaration, audit certificate. A supplier that owes a CoA and has none on file reads as missing from that moment, rather than quietly not existing anywhere.
- Upload the certificates you already hold
The CoAs sitting in the shared drive go in against the supplier and the certificate type, as PDF, PNG or JPEG, with their issue and expiry dates. That is the one-off migration, and it is the point at which the status view starts telling you something you did not already know.
- Set the days you want to be warned on
Alerts start at 90, 60 and 30 days before expiry. In the alert settings you can change those days per certificate type or set a plant-wide default, so a CoA that renews on a short cycle is not warned about on the same clock as a three-year audit certificate. A scheduled daily check recomputes each certificate's status against those thresholds.
- Send the supplier a link instead of starting an email thread
For anything missing, the supplier contact gets a single-use link that expires, and uploads the document straight into its slot. No login, no password, no portal invitation to a quality manager who would never sign in twice.
- Let the chase sequence carry the follow-up, or chase now
Certificates approaching expiry or already lapsed are chased by email to the supplier contact, each message carrying a one-click upload link. When a date is closer than you are comfortable with, chase now sends that supplier one message immediately from the dashboard row or the supplier's own page, logged the same way as any scheduled send.
- Read one screen before the audit, then export it
The dashboard shows certificate status per supplier in one place: current, expiring soon, expired, missing. Export the same view as a PDF for the auditor, with the four status badges reading exactly as they do on screen. The week before an audit becomes a read and a short list of people to chase, instead of opening PDFs to check which version is the live one.
What changes for the QA manager
The chase stops living in your head
Follow-up on a CoA approaching expiry or already lapsed runs as an email sequence to the supplier contact, so it is not competing with the rest of your week for attention.
Suppliers need no account
A single-use, expiring link is the whole onboarding for the supplier side. The contact clicks, uploads the CoA, and is done, which is the difference between a reply in two days and a reply in three weeks.
Missing is a status, not a silence
A supplier that has never sent you a CoA shows as missing against its required certificate type. The documents you have never received are the ones a folder cannot show you.
You can tell a sent chase from a delivered one
Each send is logged against the supplier with its result: sent, failed or opened. A failed send carries its own badge and a resend action, so a bounce to a contact who has left the business is something you see rather than something you assume went through.
The thresholds are yours to set
90, 60 and 30 days is the starting point, not the rule. Change the days per certificate type or set a plant-wide default, and the status view follows the dates you chose.
Last March's CoA is still on file
A renewal does not delete the document it replaced. When an auditor asks which certificate of analysis was valid on a date that has passed, the superseded version is still there with its own issue and expiry dates.
CoAs sit beside the other required documents
Allergen declarations and audit certificates are tracked the same way against the same supplier record, so the certificate of analysis is not managed in a separate system from everything else the supplier owes.
One plant, one data set
Certly is scoped to a single plant, with every query filtered to your plant's data, so what you see on the dashboard and what the auditor sees is your site and nothing else.
Where CoAs usually live, and what Certly does instead
| Where the CoA lives today | What goes wrong at audit | What Certly does |
|---|---|---|
| A folder on the shared drive | Current and superseded look identical until you open each file | Each document is tied to a supplier and a certificate type, with a status against it |
| A spreadsheet of expiry dates | It is only as current as the last person who remembered to update it | Status per supplier on one screen: current, expiring soon, expired, missing |
| The QA inbox | The CoA is in a thread under a subject line nobody can reconstruct | Uploads land against the supplier whether you add them or the supplier does |
| A calendar reminder to chase | The chase happens when there is time, which is rarely the week it is due | Chase emails on your own thresholds, plus chase now, each send logged with its delivery result |
| This year's CoA saved over last year's | The question about the document valid in March has no answer left | A renewal keeps the version it replaced, with the dates it was valid between |
| The supplier's own customer portal | You are logging into their system on their terms to retrieve your evidence | A single-use expiring link, so the supplier sends to you without an account |
What Certly keeps, and what you can erase
Certificate records are the evidence trail, so they are kept while the account is open: expired certificates, superseded versions and the chase history included.
A supplier you stop buying from can be archived. Its records stay where an auditor can still see them and its reminders stop, so the expired and missing counts on the dashboard describe the suppliers you actually buy from.
Supplier contact names and email addresses are personal data, and a contact may ask for theirs to be removed. That action sits on the supplier's own page behind a confirmation that spells out what goes, the contact name and email, and what stays, the certificate records. Any unused upload link already sent to that contact stops working at the same moment, so the erasure is not a paper exercise.
The site name you set heads the audit PDF and names your plant in the emails a supplier receives, and every supplier and certificate query is filtered to your plant. Sign-in is by email and password. The application and its database run on Amazon Web Services, with uploaded certificate documents held in that database rather than a shared file store. There is no independent security certification, no single sign-on and no standard data processing agreement ready to countersign today, and the security page says so plainly rather than implying otherwise.
Where CoA collection sits in the rest of the supplier programme
The certificate of analysis is one document in a set. If you are still deciding what the set should be, the guide to what documents to collect from every food supplier covers the full list, and the glossary entry on the certificate of analysis covers what a usable CoA should contain and how its validity period is normally expressed.
Three neighbouring jobs are written up separately rather than repeated here. Onboarding a new supplier is about getting documents in before the first delivery, which is a different sequence from renewing a lapsed one. Sending a supplier an upload link yourself, and reading the exact wording of the chase email before a supplier ever receives it, are both covered on their own pages, because QA managers reasonably want to see the message that goes out under their plant's name before it goes out.
Certly is in build and not yet open. The waitlist is the way in. Plans start at 3,228 dollars a year for one plant tracking up to 50 suppliers, and each single-site plan opens with a 14-day free trial that asks for no card at the start.
Questions
Is this a LIMS, or does it read the results inside a CoA?
Neither. Certly stores the certificate of analysis as a document against the supplier and certificate type, with its issue and expiry dates, and tracks whether it is current, expiring soon, expired or missing. It does not parse the analytical results or compare them against a raw material specification.
Do my suppliers need an account to send a CoA?
No. A supplier contact receives a single-use link that expires and uploads the document through it, with no login. That is the point of the design: the person who holds the CoA is usually not going to maintain a password for your system.
What if a supplier just emails me the CoA as an attachment?
Your QA team can upload it manually against that supplier and certificate type, as PDF, PNG or JPEG, with the issue and expiry dates. Plenty of documents will always arrive that way, so manual upload and supplier self-upload sit side by side.
Can I change the 90, 60 and 30 day alerts?
Yes. Those are the defaults. In the alert settings you can add, edit or remove a days-before-expiry threshold per certificate type, or set a plant-wide default, and the status view is computed against the days you chose.
How do I know a chase email actually arrived?
Every chase is logged against the supplier with the recipient, the time and the delivery result: sent, failed or opened. A failed send shows its own badge with a resend action next to it, so a bounce is visible rather than mistaken for contact made.
Does Certly check that a certificate is genuine?
No. It tracks and reminds. It does not verify certificate authenticity and it does not guarantee regulatory compliance, and that statement appears on the dashboard and on the exported PDF so nobody reading the output is misled about what it is.
How many suppliers and sites does a plan cover?
Starter covers one site and up to 50 suppliers at 3,228 dollars a year. Professional covers one site and up to 200 suppliers at 5,388 dollars a year. Multi-site covers up to 30 sites under one agreement with no supplier cap at 10,788 dollars a year, with site switching from one sign-in.
When can I start using it?
Certly is not open yet, so the waitlist is the route in. When it opens, sign-in is by email and password, and each single-site plan starts with a 14-day free trial that asks for no card at the start.