Onboarding a new supplier: getting its documents in before the first delivery
Collecting documents from a new food supplier is a race against a delivery date: the allergen declaration, the certificate of analysis and the audit certificate all need to be on file before the first pallet arrives. Certly is being built to hold that requirement list per supplier, send the first request as a no-login upload link, and show you on one screen what is still missing.
The week before the first delivery
A new supplier is agreed on commercial terms, and the first you hear of it is a purchase order with a delivery date on it. From that moment you are collecting documents: an allergen declaration, a certificate of analysis for the first batch, and whatever third-party audit certificate the supplier holds, or a questionnaire and a second-party assessment if it holds none.
The job is small and it is never only one supplier. You send an email asking for three documents. Two come back, one of them a phone photo of a printout. The third arrives from an address that bounces, because the person who held the file left in March. Two weeks later the goods are at the gate and your approved supplier list has a row with a blank in it.
What makes this uncomfortable is not the admin. It is that a blank row stays a blank row until someone notices it, and the person who usually notices is an auditor. Finding an approved supplier with no current allergen declaration on file, they do not ask how many times you chased. They raise a non-conformance, and you spend the following fortnight writing a corrective action for something that was only ever a missing attachment. Unannounced audits remove the week of catching up that used to absorb this.
The decision in front of you
Most plants collect new supplier documents one of three ways, and each one breaks at a predictable point.
- An email thread and a shared folder. It works for the first supplier and fails at the twentieth, because the only record of what you asked for is in your sent items, and the only record of what arrived is a filename somebody typed in a hurry.
- A spreadsheet with a column per document. Better, until the expiry dates in it are maintained by one person who is also running the shift. The spreadsheet tells you what you entered, not what is true today.
- A supplier portal with logins. Strong on control, weak on the thing that actually decides whether a document arrives: a small supplier's office manager will not create an account, remember a password and navigate a portal to send you one PDF. The request stalls at registration and you end up emailing anyway.
The trade-off worth naming is between control and friction. Every step you add on the supplier's side lowers the chance the document arrives this week. Certly is built around that: the requirement list and the status live with you, and the supplier's side of it is one link in one email, with nothing to join.
If you are still deciding which documents to ask for, there is a separate guide on this site listing what to collect from every supplier, plus short definitions of the allergen declaration, the certificate of analysis and the approved supplier list. Two further pages cover what a new supplier sees first: the chase email template you can read before anyone receives it, and a walk through what actually lands in their inbox.
Collecting the documents, step by step
- Add the supplier and say what you require from it
Create the supplier record with its company name, the contact who actually handles paperwork, and the certificate types you require from this one: allergen declaration, CoA, audit certificate. The requirement list is set per supplier, so a packaging supplier does not carry a slot it will never fill. The form checks the fields as you save, so a mistyped contact email or a missing expiry date comes back as an inline error rather than a record that quietly cannot be chased.
- Send the first request on the day you approve the supplier
Chase now, on the supplier's row or on its own page, sends that contact an immediate one-off request carrying a single-use, expiring upload link, and the send is written to the chase history marked as manual alongside the automated ones that come later. It is a deliberate click rather than something a schedule decides for you, because a slot with nothing in it yet has no expiry date for a sequence to count down from. If you want to read the message before any supplier does, the chase settings carry a read-only preview of the exact template, subject line and body.
- The supplier uploads without creating an account
No registration, no password, no support ticket from an office manager who cannot find the login. They open the link, attach the document against the certificate type you asked for, and that is the whole of their involvement. The link works once and then expires, so it cannot be forwarded around a sales inbox and reused months later. If a supplier emails you the PDF instead, your team can upload it against the same slot.
- Check the request actually landed
Each entry in the chase history carries its delivery result, sent, failed or opened, rather than leaving you to assume. A failed send shows a distinct badge with a resend beside it, so a bounce reads as a bounce instead of looking like a delivered message the supplier chose to ignore. That is the difference between chasing a supplier and chasing an address that stopped working in March.
- Watch the blanks close on one screen
Every supplier and every required type appears on a single status view, each slot reading current, expiring soon, expired or missing. A newly added supplier starts as a row of missing slots, and onboarding is finished when none of them still say missing. You are reading status rather than remembering it.
- Hand the renewal over to the chase sequence
Once a document is on file with its expiry date recorded, the automated chase emails take the follow-up from you, going to the supplier contact as the date approaches and again after it has lapsed, each message carrying a one-click upload link. The thresholds start at 90, 60 and 30 days before expiry, and you can change them per certificate type or set a default for the whole site.
The three documents a new food supplier usually owes you
| Document | Why you ask for it at onboarding | How it reaches you in Certly |
|---|---|---|
| Allergen declaration | It tells you what the supplier handles on site, which decides whether the material can be used on your lines at all. Asking after the first delivery is the wrong order. | Tick it as a required type on the supplier record. It reads missing until a document is attached, and Chase now sends the request for it on the spot. |
| Certificate of analysis | Evidence that the specific material meets the specification you buy against, usually tied to a batch rather than to the year. | Set as a required type alongside the others, with the document stored against that supplier and that type, and the version it replaces kept rather than overwritten. |
| Audit certificate | The supplier's third-party certification, the document an auditor reaches for first when reviewing your approved supplier programme. | Required type on the record, with its expiry date carried into the status view and, once on file, into the automated chase sequence. |
What this changes for the person doing the onboarding
The requirement list is fixed at the moment of approval
You decide what this supplier owes you when you create the record, not three months later when an auditor asks. The certificate types sit on the supplier, so nothing depends on remembering a conversation.
The first request does not wait for a date
Chase now works on a slot that has never been filled, so the day the purchase order lands you can send the request from the row itself rather than composing another email from your own inbox.
Nothing for the supplier to join
The upload link needs no account and no password. The friction that keeps small suppliers from responding is removed, and the link works once and then expires, so it cannot be reused later by whoever it was forwarded to.
A blank you can see rather than a blank you have to recall
Missing is a status on the board, shown per supplier and per certificate type, next to current, expiring soon and expired. A new supplier is a visible row of gaps that closes as documents arrive, rather than an item on a list you keep in your head.
Delivery you can check instead of assume
Every chase email is logged per send with its result, sent, failed or opened. When a supplier says nobody asked them, you are reading a record; when the message never left, you see that too and can resend from beside the failed entry.
Follow-up that does not come out of your week
Once a first document is on file, the chase sequence handles the approach of its expiry and the period after it lapses, so the supplier you onboarded in March is not a task you have to diarise for next March.
Something to hand the auditor
The status board exports as a PDF using the same four status labels the screen shows, headed with your site's name, and carrying the two-sentence note that Certly tracks and reminds rather than verifying or guaranteeing anything.
What Certly does not do, said plainly
Certly tracks certificates and reminds people about them. It does not verify that a certificate is authentic, it does not read the scope on an audit certificate and tell you whether it covers the material you are buying, and it does not guarantee that your supplier approval programme satisfies any certification scheme. That two-sentence note sits on the dashboard and on the exported PDF, and someone with your job still opens the document and reads it.
Two more limits worth knowing before you plan around the tool. The automated sequence is keyed to recorded expiry dates, so for a slot that has never been filled the first request is a Chase now click rather than something a schedule reasons about on your behalf. And the status view covers the suppliers and certificate types you have entered: it is only as complete as the supplier list behind it.
On the plainer infrastructure questions: sign-in is an email address and a password, there is no single sign-on or two-factor option yet, there is no independent security certification, and there is no standard data processing agreement ready to countersign or a choice of hosting region. We would rather you knew that before an IT review than after one.
None of this is a reason to keep the spreadsheet. It is the honest shape of a tracking and reminder system, and knowing the shape is what stops it being trusted for something it was never doing.
Questions
Which documents should I collect from a new food supplier before the first delivery?
At minimum the allergen declaration, a certificate of analysis for the material you are buying, and the supplier's audit certificate if it holds one. There is a fuller guide on this site covering what to collect from every supplier and when a questionnaire stands in for a third-party certificate.
Can I ask for a document before anything is on file for that supplier?
Yes. Chase now works on a row that still reads missing, sending the contact an immediate one-off request with a single-use upload link, and the send is logged as a manual one. That is how the first request for a brand new supplier goes out, rather than waiting for an expiry date to count down from.
Does the supplier need an account to send me documents?
No. The supplier receives a single-use, expiring link by email and uploads through it with no login at all. You sign in to Certly with an email address and a password; the supplier never signs in to anything.
What if the request email bounces or never arrives?
The chase history records each send with its result, sent, failed or opened, so a bounce shows as failed rather than looking like a delivered message. A resend sits next to the failed entry, and because the failure is visible you can also correct the contact address or pick up the phone instead of waiting on a route that has already failed.
Can I onboard a supplier whose certificate expires in two months?
Yes. The document goes on file with its expiry date and shows its real status on the board, and the chase sequence picks up the renewal as the date approaches, with an upload link in each message. The 90, 60 and 30 day thresholds can be changed per certificate type or set as a default for the site.
Where are the uploaded certificates kept?
On Amazon Web Services, in the product's own Postgres database, with the documents stored in that same database rather than a shared file store. Supplier company names, contact names and contact email addresses are stored alongside them so the right person can be chased when a certificate is due, and a renewal does not delete the version it replaces.
Can a supplier contact's details be removed if they ask?
A supplier contact's name and email can be erased on their own from that supplier's page, behind a confirmation that spells out what goes and what stays, and any unused upload links already sent to them stop working at the same moment. The certificate records themselves remain, because that trail is what an auditor asks for.
Does a clean status board mean my supplier approval programme passes an audit?
No. Certly tracks expiry dates and reminds the right people; it does not verify that a certificate is genuine or guarantee regulatory compliance. It is built to remove the missing-document failure mode, not to replace your judgement on whether a supplier is approved.