Collecting a current allergen declaration from every supplier

You have a list of every supplier that ships you an ingredient, a processing aid, a packaging film. Against each one there is meant to be a current allergen declaration on file. In practice there is a folder, a shared drive, or a spreadsheet with a column for it, and in that column sit a few dates from two years ago, a few blank cells, and a note that reads "emailed their quality contact in March".

Nobody disputes that the declarations should be current. The problem is that collecting them is a background task competing with everything else on a QA manager's week, and it only becomes urgent twice: when a specification changes, and when an auditor asks. An unannounced audit does not wait for you to finish chasing, and a declaration that lapsed eight months ago reads the same way on the day as one you never requested at all.

So the decision in front of you is not really which document you need, that part you already know. It is whether the chasing stays a manual job you carry in your head and your sent items, or whether it becomes a process with a due date, a logged request and a status anyone on the team can read off one screen.

An allergen declaration is a statement the supplier maintains, not one you can produce yourself. That makes it different from your own records in two ways that matter.

First, it changes on the supplier's schedule. A new line, a reformulation, a second production site, a change of co-packer, and the declaration you hold describes a factory that no longer exists. You are rarely told. Second, the renewal date is often not stated at all, and where it is, it lives on the document rather than anywhere that can prompt you, so the only thing standing between a current declaration and a lapsed one is somebody remembering to look.

The usual answer is a spreadsheet with conditional formatting and a calendar reminder. It holds up until the list grows past the point where one person can hold it in their head, or until the person who built it is on leave in audit week. What breaks is not the tracking, it is the chasing: the follow-up email that was never sent, the supplier contact who left, the reply that arrived with the file attached and was never filed.

If you want the definition of the document itself, and what a complete declaration should state, that is covered on the allergen declaration page in this section rather than repeated here.

Allergen declarations are the awkward case in any certificate register, because a great many of them carry no expiry date at all. The form is signed, it is dated, and it says nothing about when it stops being true. Vendor forms and self-assessment statements behave the same way. A third-party audit certificate tells you plainly when it lapses; an allergen declaration usually leaves the decision to you.

Most plants settle on a convention. The declaration counts as current for three years from the date on the form, or two, or one for a higher-risk material, and an auditor can still ask for an updated allergen statement if the one on file is old enough to predate a reformulation. The convention itself is rarely the problem. Remembering it is: the date sits on the document, the rule sits in your head, and nothing joins the two together.

Certly records the issue date when a certificate is uploaded and derives the due date from a renewal period you set for that certificate type at your plant. Set allergen declarations to come round again three years from the date on the form, if that is your rule, and leave the audit certificate to the expiry date it prints. Either way every row on the dashboard has a date the alerts and the chase sequence can work from, which is the whole point of writing the rule down somewhere other than your own memory.

Supplier contacts move on more often than certificates fall due, and a request sent to a dead mailbox is the quietest kind of failure. Certly is built so that failure is visible rather than assumed: the send is written to the chase log with its result, a failed send gets a distinct badge, and a resend now action sits in the same row, so once you have corrected the contact email on the supplier's page the request can go again.

Where the mail leaves from is your choice. Chase and upload-link emails are delivered through Amazon SES by default, and a site that would rather have them arrive from its own mailbox can connect a sending account instead, which is usually what keeps a request out of a supplier's spam folder. Those sending credentials are encrypted before they are stored.

The other direction matters too. Supplier contact names and email addresses are personal data, and if a contact asks to be removed you can erase their name and email from that supplier's page behind a confirmation that spells out what goes, the contact details, and what stays, the certificate records. Upload links are single use and expire on their own. Archiving a supplier you no longer buy from keeps its records for the audit trail and stops its reminders.

On storage, the two things QA managers usually ask: Certly is single-site and single-tenant per plant, with plant-scoped isolation applied on every supplier and certificate query and an automated test that runs two plants against each other to prove one cannot read the other's records, and everything runs on Amazon Web Services with uploaded certificate documents held in the product's own database rather than a shared file store.

The allergen declaration is rarely the only document you need from a supplier, and the same mechanism carries the others. Certificates of analysis follow the same collection pattern and have their own page in this section, as does the wider question of which documents to collect from a food supplier in the first place. Onboarding a brand new supplier has a page too, because there the problem is getting the first set of documents in before the first delivery rather than renewing one you already hold.

Two details people usually want to see before they hand the chasing over: the exact wording of the email a supplier receives, and what the supplier actually sees and does when the request lands. Each has a page of its own in this section.

Certly is in build and not open for sign-up yet. If collecting allergen declarations is the job you came here to solve, the waitlist is the way to hear when it opens.