Supplier onboarding

The documents a new customer asks for, kept in one place with their expiry dates.

A supplier onboarding form asks for the GDPR documents and, in the same breath, your insurance certificates, a modern slavery statement, an anti-bribery policy, a health and safety policy, any ISO or Cyber Essentials certificate, and your certificate of incorporation. Rowpa keeps them beside your record, tells you which one runs out next month, and attaches them to the pack you send.

Start free See the pack they go in

Free to upload and keep. Attached to packs on any plan that sends them.

The checklist

What a UK buyer's onboarding form usually asks a small supplier for, beyond the GDPR set:

Public liability insurance certificate, typically £1m to £5m cover. Employer's liability insurance, a legal requirement if you employ anyone. Professional indemnity insurance for advice and services. Cyber insurance, increasingly asked alongside the security questionnaire. Modern slavery statement, required by law only over £36m turnover but asked of everyone in the supply chain. Anti-bribery policy (Bribery Act 2010 adequate procedures). Health and safety policy, required in writing from five employees. Environmental policy, for tenders. ISO 9001, 14001 or 27001 certificates if held. Cyber Essentials certificate for public-sector work. Certificate of incorporation or the Companies House number.

Each has an expiry or a renewal date, and the person who sends the GDPR pack is the person asked for all of them. Today that is two emails and a search through last year's inbox.

What Rowpa does with them

Upload once, with the date it runs out

PDF, image or Word, up to 15 MB, with what it is, who issued it, the reference and the expiry. Current, expiring within 30 days, expired, or no expiry, at a glance.

Attached to the pack

The supplier due diligence pack has a documents section. The wizard attaches every unexpired document by default; untick the ones a particular buyer does not need. The reader opens each from the pack link, behind the same gate as the pack.

Told before it lapses

The weekly email lists anything expired or expiring within 30 days, and the pack's readiness check says when an attached certificate has run out, because an expired certificate in a pack tells the reader more than none.

Private by construction

Files live in a private store with no public access. A reader gets a link that lives two minutes, issued only through a pack link that is live and, if gated, after they have given their email.

Which ones are legally required

Employer's liability insurance if you employ anyone; a written health and safety policy from five employees; a modern slavery statement only above £36m turnover. The rest are asked by buyers rather than required by law, which does not make them optional in practice.

Which ones the GDPR pack already covers

Record of processing, sub-processor list, transfers, security measures, breach and complaints procedures, privacy policy, DPO or accountable person, and the attestation are generated from your record. This page is about the documents that are not.

Pricing

Free to upload and keep on every plan. They travel with the pack, which is £39 once per customer or included from Starter.

Start free See all plans

Common questions

Does Rowpa check the certificates are genuine?

No. It stores what you upload, with the dates you enter, and shows them to the buyer you send the pack to. Verification is the buyer's job, as it always was.

Can a buyer download them without the pack?

No. Documents open only through a pack link that is live and, if the link is gated, after the reader has given their email. There is no public documents page.

What happens when I upload a renewed certificate?

Upload the new one and remove the old. The next version of any pack carries the new one; packs already shared keep pointing at what they carried, so regenerate and reshare when a buyer needs the renewal.

Is this UK only?

The document kinds are named for UK practice (employer's liability, modern slavery statement, Cyber Essentials) but the store works anywhere and the kinds include other.