Work with suppliers, requests and risk

Supplier records

A supplier record holds the identity, contact details, country and the materials or processes you have recorded them as able to provide. Country matters: it feeds the risk score and the sourcing analysis.

How do I request certificates or photos?

Open Suppliers, choose Request data or documents, select the supplier and optionally link the request to a passport. Add a named document for each certificate, report or photo you need, with instructions about the product, batch, issuer or validity period. You can ask for documents alone or combine up to ten document requests with the existing questions and material or substance items.

1. Add each document by name and review the supplier preview.
2. Create the request, then choose Send invite. The supplier receives the expiring portal link.
3. The supplier chooses and uploads one PDF or raster image per requested document, then submits the completed response.
4. Open the request on the supplier page to see upload status and download the received file, or review it in the Documents vault.

Can a supplier replace an uploaded document?

Each requested document accepts one successful upload. PDF, PNG, JPEG, GIF, WebP and TIFF are allowed, with a 10 MB limit per file. The server checks the actual bytes against the extension and declared type and scans uploads before saving them. An accepted file locks its slot, even if the invitation is resent or the evidence is later deleted. If a correction is needed, create a new request; the supplier cannot overwrite the original evidence.

Rejected or interrupted attempts that saved no file leave the slot open. A saved receipt remains visible after reloading the portal. The response cannot be finalized, including by a team member recording an outside answer, until every requested document has been uploaded.

Who can read supplier uploads?

Uploads enter your organization's document vault as restricted evidence, linked to the request's passport when there is one. The supplier link shows a receipt, without a vault download link or storage key. Downloads require an authorized organization session. Uploads are logged with the supplier, request, document id, hash and size; a received file is evidence to review, not proof that its claims are genuine.

Asking for data

A data request is a question with a link. Create it from the supplier, and the platform issues a tokenised portal link, emails it and records the request.

The link is single-use, expiring and stored hashed. The response form is deliberately bounded: a flat set of fields with length limits, so a supplier cannot paste an unbounded document into your data model. What they submit is audited and attached to the request.

Trust and risk scoring

Each supplier shows a trust signal built from how often they respond and how promptly, and a risk score combining the response rate, the country tier and recency.

The score is a deterministic local-signal heuristic. It is not a sanctions check, a credit rating or an audit. Treat it as a prompt to look closer, and record your own judgement alongside it.

Recording capabilities

Capabilities are what a supplier can actually make: materials, certifications with their validity dates, and lead time. Recording them is not paperwork - the sourcing module can only propose alternatives from suppliers whose capabilities are on file.

The supply chain view

Tier 1 comes from supplier responses; tier 2 and beyond come from what those responses declare about their own upstream. The passport page renders the tree and an upward rollup with coverage and arithmetic conflicts, where a node declares less than the sum of what it says is below it.

Can a supplier pass questions to its own supplier?

Yes. In the portal, a supplier can forward questions and requested documents from your request - never anything you did not ask - to its own supplier, up to tier 5 and ten forwards per request. The upstream supplier receives its own private link and answers you directly; the forwarding supplier never sees that link. Forwarded suppliers appear in your supplier list and count towards your plan's supplier limit.

The forwarding supplier decides whether you learn who its supplier is. If it keeps the identity private, you see a label such as "Tier 2 supplier via Cell Co" with the country it gave, plus every answer and document; the name and e-mail are stored encrypted and used only to send the invitation. The passport's supply-chain view nests forwarded answers under the supplier that forwarded them and checks that declared footprints add up across tiers.

Screen-by-screen reference

These pages were checked in the organization console on 8 October 2026 using an isolated sample organization. Controls can differ by role, plan, record state and configured providers. Each page below explains its purpose, a practical workflow, the visible controls and what to verify afterward.

Suppliers (/suppliers)

The supplier list and data requests show who contributes information to the portfolio and which replies are outstanding.

Create a supplier record before sending a data or document request so replies can be tied to a known contact. Choose the passport, requested fields or item questions, and required files precisely; then send the invitation from the supplier workflow. Review each returned statement and document before accepting it into a product or passport.

Supplier answers are source statements and still require review.

Controls and options

• Add supplier stores contact details; open a row for its record, risk and identity checks.
• Request data or documents chooses a passport, field or item questions, requested files and supplier.
• Send an invitation from the supplier workflow; an off-portal response can be recorded with its source.
• Inspect request status and uploaded files before accepting information into a passport.

Supplier detail (/suppliers/[id])

A supplier record combines contact information, deterministic risk scoring, screening, verified identifiers and request history.

Check contact details and identifier verification before relying on a supplier's response. Risk assessment explains its recorded inputs; screening results need a named list or service, date, and reference to be useful later. Open the request history to trace an answer to its source and issue a focused correction request when evidence is rejected.

A verified domain or risk score is a specific signal, not a blanket approval of every supplied fact.

Controls and options

• Edit supplier contact and save current organization details.
• Add and check an LEI, EU VAT number or DNS domain to verify the supplier's identity.
• Assess supplier recalculates the risk estimate from recorded data and explains its inputs.
• Record screening result against a named list or service, with date and reference; Dry run avoids saving.
• Open request history to send or review evidence and responses.