Supplier document portals: scope, review and renewals

This guide is for Procurement, operations and IT teams collecting documents from external companies. Its scope is supplier onboarding and record maintenance: requirements, versions, review and renewal. Invoice automation and bank reconciliation address different purchasing decisions.

List requirements by supplier type and business relationship. Identify the owner, covered period, verification method and authority to grant an exception. Not every file expires: issue dates, internal review dates and stated validity are different fields. The responsible team defines the rules; software applies and versions them.

Existing products address this problem. Trebol presents supplier records, alerts and expiry suspensions. Centum presents a portal connected to purchasing, invoices and payments. In Mexico, Focaltec includes supplier files and fiscal checks. These are supplier descriptions consulted on October 23, 2026, rather than products tested or endorsed by Duotach.

Ask each candidate to walk through the same fictional record: onboarding, rejection, correction, approval, expiry and renewal. Identify what can be configured, what needs an extra module and what requires development. A feature list does not show how exceptions work.

An existing platform is a candidate when its rules, access model and export cover the process. Custom development can address a specific gap such as cross-team review, multiple contracting entities or a missing connection. Avoid rebuilding an entire portal to solve one notification. Include migration, storage, support and exit costs in the comparison.

The workflow needs to distinguish received, under review, needs correction, approved and expired, or the equivalent agreed statuses. Each transition should identify the actor, timestamp, document version and reason where relevant. Uploading a replacement should preserve the previous approval history.

State what approval means: by whom, for which company, relationship or period. Approval for one relationship does not automatically authorize every other one. The dashboard should explain why a record is pending, what is missing and who owns the next action.

The following matrix is a purchasing framework proposed by Duotach. It does not describe an installed proprietary product or client results.

Ask the proposal to specify the time zone, evaluation time and response when a requirement expires. An alert, a flag on the record and an operational block are separate behaviors. The process owner approves the consequence; a dashboard color does not define it.

If a block is agreed, specify the action it prevents, such as new orders or access to a facility. Define how work already in progress and authorized exceptions are handled. Do not block payments or sensitive decisions through a generic rule without review by the responsible team.

For reminders, agree on recipients, frequency and escalation. A sent email does not establish that a document was renewed. The portal needs to expose the outstanding action and response, including failed notifications and staff departures.

Check that one supplier cannot read or change another supplier’s documents, including through direct links, downloads and exports. Separate internal access by function and agree on account revocation. A hidden button does not demonstrate that the file is protected.

The OWASP authorization guide, consulted on October 23, 2026, recommends least privilege, denial by default and authorization checks on every request. Ask for test evidence across users and resources; citing the guide does not establish implementation.

The OWASP file upload guide, consulted on the same date, recommends limits on formats and sizes, type verification and authorized upload access. Also agree on storage access, risk-based file scanning, retention, deletion and recovery. Private files should not become public links for download convenience.

If OCR or AI is proposed, define its role: suggesting a document type, extracting a date or flagging a missing field. Preserve the source and allow extraction corrections. A correctly extracted date does not establish authenticity, legal validity or supplier compliance.

Use authorized examples with different formats and quality levels; measure extraction and decisions separately. Define how ambiguous files reach human review. Agree on which content can go to external services and which records are retained before using real documents.

Fiscal, employment and access requirements depend on country, activity and contract. Procurement and its advisers define applicable requirements and verification. This guide does not list legal obligations or offer certification. Ask each external integration to identify its source, permissions, expected response and failure handling.

Request a requirements catalog, status workflow, permissions matrix, expiry and exception policy, and test record. Include relevant migration, file and history exports, and ownership of rule maintenance after handover.

For acceptance, run the fictional record through supplier and reviewer accounts. Test a correction without losing the previous version, expiry at the agreed time, access revocation and file recovery. Record which failures prevent release for use. For integrations, also check that retries neither duplicate onboarding nor silently change status.

Duotach builds custom software. We can discuss a paid scope for a document portal or a missing part of an existing system, subject to agreed access, compatibility and capacity. Assessment, configuration and testing of your process belong in the contracted work. This is not compliance certification or a free preliminary audit.

In your inquiry, describe the reviewing team, supplier types and the point where work stalls. Do not attach personal documents, keys or confidential supplier records. For custom development, also agree on code, accounts and operational handover.