Where your supplier and certificate data is stored

Certly runs on Amazon Web Services. Your supplier list, the required certificate types against each supplier, expiry dates, alert settings and chase history are held in the product's own Postgres database there.

The certificate documents themselves, the PDFs, PNGs and JPEGs that you upload or that a supplier sends through an upload link, are stored in that same database rather than in a separate shared file store. When an auditor or an IT reviewer asks where the allergen declarations, CoAs and audit certificates actually sit, that is the whole answer: one database, on AWS, scoped to your plant.

It is a short answer on purpose. There is no document store standing beside the database, no third tool holding the files, and nothing to reconcile between the two when a reviewer asks for the version of a declaration that was current on a given date.

Nine categories, and nothing beyond them. The written declaration the table is drawn from once named one more, a multi-site price request holding a number of sites, a note and an email address. No such feature exists in the product, so that line was taken out rather than left standing as a claim about data Certly never collects.

It matters in both directions when you are filling in a due diligence questionnaire. An over-long list invites questions about data that was never gathered, and a short one has to be honest about everything that is. Where the product adds a surface that collects something new, this is the list that changes with it, which is why the sending-account credentials and the record of product actions appear here by name rather than under a heading like operational data.

People sign in with an email address and a password.

Certly is single-site and single-tenant per plant, and every supplier and certificate query is scoped to the signed-in user's plant by design: reads are filtered to that plant, and the scoping is tested route by route across the supplier API, the certificate API and the dashboard loaders. We describe it as the design rather than as an audited guarantee, because no independent security audit has been carried out.

The sibling page on plant level data isolation sets out how that scoping holds across the dashboard, the supplier list and the PDF export, and there is a separate page on how sign-in works today, including single sign-on and two-factor authentication, neither of which is in place yet.

Deleting the account

Delete your account from Settings, Site details, confirming with your email address. Your sites, suppliers, certificate documents, chase history, settings and sign-in details are removed at once, and any live subscription is cancelled. The sibling page on deleting your account walks through what an auditor would no longer be able to ask for afterwards.

Taking a copy first

The same screen downloads a JSON file of your data before you delete anything, so the supplier records, dates and chase history do not have to be re-keyed somewhere else to be kept.

Erasing one supplier contact

A supplier contact's name and email can be erased on their own from that supplier's page, through a right-to-erasure action for supplier contact personal data. A confirmation step spells out what will be removed, the contact name and email address, and what will remain, the certificate records.

One limit worth knowing rather than discovering: an upload link already sent to that contact stays valid until it is used or until it expires on its own, because each link is single use and time limited. Closing live links at the moment of erasure is work on the list, not behaviour we will claim today.

Retention while the account is open

Everything is kept while your account is open: expired certificates, the superseded versions a renewal replaced, and the chase history, because that trail is what an auditor asks for. A renewal never deletes the document it replaced, so the question of which declaration was valid last March has an answer. Archiving a supplier you no longer buy from keeps its documents and chase history on file and stops its reminders. Upload links expire on their own, and the record of product actions is the one thing with a shorter clock: anything older than sixteen weeks is deleted.

Three outside services, and no more than three. The practical consequence of the mail path is worth stating plainly: a supplier contact's name and email address are passed to whichever sender delivers the message, so that the person receives the chase and the one-click upload link, and the delivery result comes back so the log reflects what actually happened rather than what was attempted.

Which sender that is depends on your own choice. Connect your plant's mailbox and the message leaves from your own sending account, with its credentials encrypted before they are stored. Connect nothing and Amazon SES carries it, on the same AWS account that hosts the database. Connect a Resend account instead and Resend carries it and reports opens back.

If you are working out your own controller and processor position on supplier contact details before you put them into any system, the guide on handling supplier contact data when you automate certificate chasing covers that side in full, and there is a short page on how right to erasure applies to a single supplier contact.