Food safety compliance software for small manufacturers: the certificate part
If you run quality at one plant with a few dozen approved suppliers and no document control department, most food safety compliance software is built and priced for someone much larger. Certly takes one part of that job and does it properly: collecting supplier certificates, tracking when they expire, and chasing the suppliers who have not sent the next one.
How a small plant does this today, and where it comes apart
A mid-market plant usually has one QA manager, sometimes a technical administrator for part of the week, and somewhere between twenty and two hundred approved suppliers. The certificate side of the approved supplier programme lives in two places: a spreadsheet holding supplier names, required certificate types and expiry dates, and an email folder where the PDFs actually sit. Both are accurate on the day they were last touched.
What fails is not the spreadsheet, it is the calendar around it. Allergen declarations, certificates of analysis and third party audit certificates all renew on their own schedule. A supplier changes the person who issues them, a contact leaves, a renewal slips by three weeks, and a row that still reads green has an expiry date in the past. Nobody notices until an auditor opens the file, or until an unannounced visit lands in a week that was already full.
The cost is not abstract. A missing or out of date certificate on file is one of the easiest non-conformances for an auditor to raise, because it needs no interpretation: either the document is current or it is not. Closing it out means a corrective action, evidence, and in some cases a re-audit fee and a follow up visit, all for a document the supplier would have sent on request.
Where this page stops, and where the buying guide starts
Certly is a certificate tracking and reminder system for supplier documents, scoped to one plant at a time, and that is the entire product. It does not build HACCP plans, hold CCP monitoring records, run traceability exercises or manage corrective actions. If the open question is still which category of software a plant your size needs at all, our guide to choosing food safety and supplier document software as a small plant works through that comparison, and it is linked below.
The rest of this page is mechanics: what happens to a single certificate between the day it reaches you and the day an auditor asks to see it. Whichever scheme you certify to, the questions at the table are similar. Show the certificate for this supplier, show that it is current, show what you did when the last one lapsed. Certly is built to answer the first two from one screen and to make the third a logged record rather than a memory.
The certificate workflow, start to finish
- List your suppliers and what each one owes you
Add suppliers with contact details and the certificate types you require from them, such as an allergen declaration, a CoA or a third party audit certificate. The required list is per supplier, so an ingredient supplier and a packaging supplier do not have to share the same demands.
- Upload the documents you already hold
Your QA team uploads certificates manually, each one tied to a supplier and a certificate type with its expiry date, in PDF, PNG or JPEG. Once that date sits against a slot it becomes something the product can compute a status from, rather than a line in an email somebody has to open and read.
- Send a self-upload link for the gaps
Suppliers upload without an account through a single-use, expiring signed email link. There is no portal to register for and no password to reset, so a supplier contact with no appetite for another set of credentials can still send you the document.
- Set the alert thresholds you actually work to
Expiry tracking runs on configurable thresholds at 90, 60 and 30 days before expiry, computed by a scheduled job. You can adjust the days before expiry per certificate type or set a plant-wide default, so a document with a long renewal lead time can be chased earlier than one that takes a week.
- Let the chase sequence do the asking
Automated email sequences go to the supplier contact for certificates approaching expiry or already lapsed, each one carrying a one-click upload link, and each send is logged. When you need to push a specific supplier immediately, a chase now action sends a one-off email that lands in the same log.
- Work the dashboard by status, not by scrolling
One screen shows certificate status per supplier: current, expiring soon, expired, missing. The week before an audit stops being a reconciliation exercise and becomes a short list of rows that are not green yet.
- Export the pack for the auditor
The dashboard exports as a PDF for auditor review, with the same four status labels and badges as the screen and a short disclaimer stating what the platform does and does not do. You hand over a document that matches what you have been looking at all quarter.
What matters when you are the whole QA function
Suppliers do not have to be onboarded
The no-login upload link means adoption is not a project. Nobody at your supplier has to be trained, invited or chased about credentials, and the link expires after one use so an old email cannot be reused.
Missing is a status, not a blank cell
Spreadsheets hide absence well: a row with no expiry date looks the same as a row nobody has filled in. Certly treats a required certificate with nothing uploaded as missing and shows it alongside expired, which is usually where the audit finding was going to come from.
The chasing happens whether or not you remember
Thresholds at 90, 60 and 30 days mean the first ask goes out while the supplier still has a comfortable window. The sequence keeps going for lapsed certificates, so a renewal that stalls does not quietly become an expired document on file.
You can prove you asked
Every chase is logged per send with its status, including failed sends, with a resend action next to them. When an auditor asks what you did about a lapsed certificate, the answer is a dated record of requests rather than a recollection.
The document that was valid last March is still there
Expired certificates, superseded versions and chase history are kept while your account is open, and a renewal does not delete the document it replaces. That is the trail an auditor asks for when the question is about a past date rather than today.
One plant, its own data
Certly is single-site and single-tenant per plant, with plant-scoped isolation enforced on every supplier and certificate query. Your supplier list and your certificates stay inside your plant's scope.
Supplier contact data can be removed
Supplier certificates and contact records carry named individuals. A right-to-erasure action deletes a supplier contact's name and email behind a confirmation that explains what goes and what stays, and any unused upload links sent to that contact stop working at the same moment, so the certificate history remains while the personal data does not.
The four statuses and what happens in each
| Status | What it means | What Certly does |
|---|---|---|
| Current | A certificate is on file and its expiry date is beyond your alert thresholds | Shows as current on the dashboard and in the PDF export, and waits |
| Expiring soon | The expiry date falls inside a configured threshold, by default 90, 60 or 30 days out | Emails the supplier contact with a one-click upload link and logs each send |
| Expired | The expiry date has passed and no newer document has been uploaded | Continues the chase sequence for the lapsed certificate and flags the row on screen and in the export |
| Missing | A certificate type is required for that supplier and nothing has been uploaded yet | Shows the gap on the single-screen status view so it is visible before an auditor finds it |
Pricing by supplier count, not by module
Starter, $3,228 / year
For a single plant tracking up to 50 suppliers, with a 14-day free trial. Billed annually, which works out at 269 dollars a month, 10 percent off the 299 dollar monthly rate for paying up front. Includes the supplier database with required certificate types, expiry tracking with 90, 60 and 30 day alerts, automated chase emails with supplier self-upload links, and the audit-ready dashboard with PDF export. Limits: 50 suppliers, 1 site.
Professional, $5,388 / year
For a single plant with a deeper supplier base, up to 200 suppliers, with a 14-day free trial. Billed annually, which works out at 449 dollars a month, 10 percent off the 499 dollar monthly rate for paying up front. Everything in Starter, tracking up to 200 suppliers. Limits: 200 suppliers, 1 site.
Multi-site, $10,788 / year
For groups and consultants covering up to 30 sites under one agreement. Billed annually, which works out at 899 dollars a month, 10 percent off the 999 dollar monthly rate for paying up front. Everything in Professional, no supplier cap, up to 30 sites, and sites are added and switched from one sign-in. The 14-day trial is declared on Starter and Professional, not on this plan.
Questions
Is Certly food safety compliance software?
Only in one narrow sense. Certly is a supplier certificate tracking and reminder system: it holds your supplier list and required certificate types, stores the documents, tracks expiry dates and chases suppliers. It does not build HACCP plans, hold CCP monitoring records, run traceability exercises or manage corrective actions, so it sits alongside whatever you use for those rather than replacing it.
Does Certly check that a certificate is genuine or valid?
No. It tracks the certificate type, the document and the expiry date you record, and reminds you and the supplier before that date passes. It does not verify authenticity and does not guarantee compliance with any scheme. The judgement on whether a document is acceptable stays with your QA team.
Do my suppliers need an account or a portal login?
No. Suppliers upload through a single-use, expiring signed link sent by email, with no login step. Your own team signs in with an email address and password.
What does it cost for a small plant?
Starter is $3,228 a year for a single plant tracking up to 50 suppliers, and Professional is $5,388 a year for up to 200 suppliers. Both are billed annually, both carry a 14-day free trial, and both include the full feature set, so the sizing question is your supplier count rather than which modules you need. Card payments and subscriptions run through Stripe.
We have two sites. Can Certly cover both?
Starter and Professional are single-site, and the product is single-tenant per plant with data scoped to that plant on every query. For groups and consultants there is a Multi-site plan at $10,788 a year covering up to 30 sites under one agreement, with no supplier cap and sites added and switched from one sign-in.
Which certificate types can I track?
You set the required certificate types per supplier, for example an allergen declaration, a certificate of analysis or a third party audit certificate. Each uploaded document is tied to a supplier and a certificate type with its expiry date, and PDF, PNG and JPEG files are accepted.
Can I change the alert timings?
Yes. The default thresholds are 90, 60 and 30 days before expiry, and they are configurable: you can add, edit or remove a threshold per certificate type, or set a plant-wide default, so documents with long renewal lead times get chased earlier.
How is supplier personal data handled?
Supplier contact records hold a company name, a contact name and an email address, and every chase email is logged with its recipient, time, delivery result and opens. A right-to-erasure action deletes those contact fields behind a confirmation explaining what is removed and what remains, which is the certificate records themselves, and any unused upload links to that contact stop working at once. Hosting is Amazon Web Services, with the database and the certificate documents in the product's own Postgres; Stripe takes payments and Resend delivers the emails. To be straight about the gaps: there is no independent security certification, no standard data processing agreement ready to countersign, and no choice of data residency region today.