Getting supplier documents audit ready for recertification
If you are getting audit ready and the weak point is supplier documents, this page is about that specific job. Certly tracks every certificate you require from your suppliers, shows current, expiring soon, expired and missing on one screen, and chases the supplier contacts who still owe you paper before the auditor asks.
The weeks before recertification, from your desk
The job in front of you
The recertification date is on the calendar, or in the case of an unannounced audit it is not, and the part of the approved supplier programme that occupies you is not the procedure. It is the folder behind the procedure: every supplier on the approved supplier list, each one owing some combination of an audit certificate, an allergen declaration and a current CoA, with no single place that tells you which of those documents has gone out of date.
So the pack gets built the way it usually gets built. The spreadsheet comes out, you sort by expiry date, and you find that some of the dates were typed in from a PDF eleven months ago and no longer match the document on the drive. Then you start chasing suppliers for their certs, in ones and twos, between line issues and a complaint investigation. Two suppliers reply with a certificate that expired in March. One has changed its quality contact and nobody told you. The rest have not replied yet, and you will remember to follow up when you next open that email thread.
What you are actually deciding
By the week before the audit the question has narrowed. It is not whether the programme is documented, it is which suppliers have an out-of-date certificate on file that an auditor could write up, which have nothing on file at all, and how many working days are left to get a replacement in. An expired certificate on file is a documentation finding waiting to be raised. A missing one is harder, because you cannot evidence approval for that supplier at all.
And the cost of finding out late is not the finding itself. It is the corrective action write-up, the evidence gathering, the follow-up with a certification body and, depending on the severity, a return visit, all of which lands on your week rather than on the supplier who was slow to send a PDF. Sibling pages on this site cover what a non-conformance means by severity, and what changes when the visit is unannounced.
Certly is built for exactly that stretch of work: getting the supplier document pack into a state where one screen tells you what is current, what is close, what has lapsed and what was never received, early enough that chasing is routine rather than frantic.
The four states a supplier document can be in
| Status | What it means | The move before the audit |
|---|---|---|
| Current | A certificate is on file for that supplier and type, with an expiry or next-due date still ahead of today. | Nothing. It appears in the pack as evidence and you spend no time on it. |
| Expiring soon | The due date falls inside one of your alert thresholds, set at 90, 60 and 30 days before expiry. | Let the chase sequence ask, and check the send log if the supplier is one of the slow ones. |
| Expired | The document on file has passed its date, so it evidences nothing on audit day. | Treat it as an open item: chase now, and record what you are doing while the renewal is in progress. |
| Missing | You have named the certificate type as required for that supplier and no file has been received. | The most urgent column. Send the upload link and decide whether the supplier can be presented as approved. |
How the document pack comes together in Certly
- Write down who owes you what
In the supplier database you add and edit suppliers with their contact details and the certificate types you require from each one, such as an allergen declaration, a CoA or an audit certificate. This is the step that makes gaps visible: once a required type is named, a supplier with nothing on file reads as missing rather than quietly not existing.
- Load the certificates you already hold
Your QA team uploads files by hand, each one tied to a supplier and a certificate type, with its issue date and expiry date recorded. The forms validate what you enter, so a bad email address or a missing certificate type comes back as a field-level error rather than a half-finished record you discover in audit week.
- Give the documents with no printed expiry a due date
Allergen declarations and vendor questionnaires often carry no expiry date at all, only the date they were signed. You set a renewal period per certificate type for your plant, and an upload with an issue date derives its due date from that period, so a declaration signed three years ago stops reading as current and starts reading as due.
- Set the thresholds so the work starts early
Expiry tracking is computed by a scheduled job against alert thresholds at 90, 60 and 30 days before expiry. In the alert settings you can add, edit or remove a threshold per certificate type, or set a plant-wide default, because a third-party audit certificate needs a longer runway than a CoA.
- Let the chase sequence do the asking
Automated email chase sequences go to the supplier contact for certificates approaching expiry or already lapsed, each carrying a one-click upload link, and every send is logged per supplier. Each log entry shows whether the message was sent, failed or opened, so a bounce is visible rather than assumed delivered, with a resend beside it. When something cannot wait for the next step in the sequence, chase now sends a one-off immediately from the dashboard row or the supplier record.
- Let suppliers upload without an account
The link in the chase email is a single-use, expiring signed link, so the supplier's quality contact uploads the PDF without creating a login or remembering a password. Once the link has been used, or once it has expired, it stops working and the upload page says so.
- Read one screen, then export it
The audit-ready dashboard is a single-screen certificate status view per supplier: current, expiring soon, expired, missing. When you want the pack in a form you can hand over or file, you export that view as a PDF for auditor review, headed with your site's name and using the same status labels and badges as the screen. There is a sibling page on this site covering what that export contains.
What this changes in pre-audit weeks
Pre-audit prep becomes a review, not a rebuild
Because due dates are tracked continuously by a scheduled job rather than recalculated by hand when the date approaches, the work in the final weeks is reading the four statuses and dealing with the short list, instead of rebuilding a spreadsheet from a folder of PDFs.
The chasing stops being your personal to-do list
Chase emails go out on a sequence to the supplier contact, with the upload link in the message. You are no longer the reminder mechanism for forty suppliers, and you do not have to keep a parallel list of who you have already emailed twice.
Ninety days of warning instead of thirty
The 90, 60 and 30 day thresholds mean a lapsing audit certificate surfaces while a renewal is still a normal request. You can set those thresholds per certificate type, so an audit certificate that takes a certification body weeks to reissue gets a longer runway than a CoA you can ask for on the day.
The declaration with no expiry date gets one anyway
A renewal period set per certificate type turns the issue date on an allergen declaration or a vendor form into a due date, so the documents that quietly never expire are the ones an auditor can no longer catch you out on.
One answer when the auditor asks about a supplier
The status view is per supplier, so when you are asked to evidence approval for a specific ingredient supplier you open one screen rather than three folders and a spreadsheet tab.
A record of the asking, not just the receiving
Every chase send is logged with its recipient, time and delivery result. When a certificate genuinely has not arrived, you can show what was requested and when, which is a more defensible position than an empty row.
The gap you cannot see in a spreadsheet gets a name
Because you name the certificate types required from each supplier, a supplier with nothing on file shows as missing on the dashboard rather than as an empty cell nobody reads. The hardest item to answer on audit day is the one you did not know was outstanding.
Something to hand over at the end
The PDF export turns the same status view into a document you can send ahead of the visit or keep with your document control records, using the labels the dashboard uses.
What Certly does not decide for you
Certly tracks and reminds. It does not verify certificate authenticity and it does not guarantee regulatory compliance, and that sentence sits on the dashboard and on the PDF export rather than in a footnote, because the distinction matters to you more than it does to us.
So the judgement stays with you. Is the scope on that audit certificate the right scope for the material you buy. Is the issuing body one you accept. Does the allergen declaration match the specification. Certly's job is to make sure that when you sit down to make those calls, you are looking at a document that is in date and present, and that you found the gaps before your auditor did.
How the data is held
Each plant is its own tenant, with plant-scoped data isolation applied on every query, so one plant's suppliers and certificates are not readable from another. A group on the Multi-site plan covers up to 5 of those sites under one agreement and adds or switches between them from one sign-in. People on your QA team sign in with email and password. Certly is hosted on Amazon Web Services, in the product's own Postgres database, and uploaded certificate documents are stored in that same database rather than a shared file store.
Chase and upload-link emails leave through Amazon SES for a site that has not connected its own sending account. Connect one and they go from your own mailbox instead, which is what keeps them out of a supplier's spam folder; the from address, mail server, sign-in name and mailbox password or API key are encrypted before they are stored. A site that would rather connect a Resend account can do that, and Resend reports opens back. Either way, every send is logged with its recipient, time, delivery result and opens, which is where the sent, failed and opened statuses in the chase log come from. Stripe takes card payments and your subscription status is mirrored from it, so card numbers never reach our servers.
What is kept, and for how long: everything stays while your account is open, expired certificates and chase history included. Archiving a supplier keeps its records and stops its reminders. Records of the product actions you complete, a chase sent, a certificate uploaded, an audit PDF exported, stay in Certly's own database with no third party analysing them, and those action records are deleted after 16 weeks. Deleting your account from Settings, Site details, confirmed with your email address, removes your sites, suppliers, certificate documents, chase history, settings and sign-in details at once and cancels any live subscription, and the same screen downloads a JSON file of your data first. A supplier contact's name and email can also be erased on their own from that supplier's page, behind a confirmation that explains what is removed, the contact name and email, and what remains, the certificate records.
What is not in place yet
If your group's procurement or IT review asks for these, the answer today is no, and it is better that you hear it here than three weeks into an evaluation.
- An independent security audit or certification such as SOC 2 or ISO 27001
- Single sign-on, whether SAML or OIDC, and two-factor authentication
- A standard data processing agreement ready to countersign
- A published backup and disaster-recovery schedule
- A choice of data residency region
Plans
Starter, $3,228 / year
For a single plant tracking up to 50 suppliers. Billed annually, which works out at 269 dollars a month, 10 percent off the 299 dollar monthly rate for paying up front. Includes the supplier database with required certificate types, expiry tracking with 90, 60 and 30 day alerts, automated chase emails with supplier self-upload links, and the audit-ready dashboard with PDF export. Carries a 14-day free trial.
Professional, $5,388 / year
For a single plant with a deeper supplier base, up to 200 suppliers. Billed annually, which works out at 449 dollars a month, 10 percent off the 499 dollar monthly rate for paying up front. Everything in Starter, tracking up to 200 suppliers. Carries a 14-day free trial.
Multi-site, $10,788 / year
For groups running up to 5 sites under one agreement, with no supplier cap. Everything in Professional, plus up to 5 sites and the ability to add and switch sites from one sign-in. Billed annually, which works out at 899 dollars a month, 10 percent off the 999 dollar monthly rate for paying up front.
Questions
What documents should I collect from food suppliers?
That is set by your scheme, your specifications and your own approved supplier programme, not by us. In practice the types QA teams track most often are the supplier's third-party audit certificate, an allergen declaration and a current CoA, and Certly lets you name the required certificate types per supplier so anything you have decided you need shows as missing until it arrives.
How does Certly track supplier certificate expiry dates?
Each uploaded certificate is stored against a supplier and a certificate type with its issue and expiry dates. Where a document carries no printed expiry, you set a renewal period for that certificate type and the due date is derived from the issue date on the form. A scheduled job computes status against your alert thresholds, set at 90, 60 and 30 days before expiry, and the certificate appears on the dashboard as current, expiring soon, expired or missing.
Do suppliers need an account to send a certificate?
No. The chase email carries a single-use, expiring signed link that opens an upload page, so the supplier's contact sends the file without a login. Once the link has been used or has expired it stops working and the page says so.
Can I change the reminder timings for different certificate types?
Yes. The alert settings list each certificate type with its days-before-expiry thresholds, and you can add, edit or remove a threshold per type or set a plant-wide default, then save the change.
What if a supplier ignores the chase emails?
Every send is logged on the supplier record with its status, sent, failed or opened, and a failed send gets a distinct badge and a resend action. When you need to escalate immediately rather than wait for the next step in the sequence, chase now sends a one-off email from the dashboard row or the supplier record.
Which address do chase emails come from?
By default they leave through Amazon SES. You can connect your own sending account instead, giving the from address, mail server, sign-in name and mailbox password or API key, which are encrypted before they are stored, so the message arrives from your plant's mailbox rather than a stranger's domain. A site that prefers a Resend account can connect one, and Resend reports opens back.
Does Certly check that a supplier certificate is genuine?
No. Certly tracks and reminds; it does not verify certificate authenticity and it does not guarantee regulatory compliance, and that sentence sits on the dashboard and on the PDF export so nobody reading either one mistakes a green badge for a verification. Judging the scope, the issuing body and the fit to your specification stays with your QA team.
What does Certly cost, and does it cover more than one plant?
Starter is $3,228 a year for a single plant tracking up to 50 suppliers and Professional is $5,388 a year for up to 200 suppliers, both billed annually with a 14-day free trial. Multi-site is $10,788 a year for groups running up to 5 sites under one agreement, with no supplier cap and sites you add and switch between from one sign-in. Each plant stays its own tenant, with plant-scoped data isolation on every query.