Certificate of analysis (COA) intake for supplement brands
The short version
- Every batch of a supplement brand's product carries a paper trail: the certificate of analysis from the lab, the specification sheet from the contract manufacturer, stability and allergen documentation, and the compliance pack retailers and marketplaces request during onboarding and reviews.
- Collecting that trail over email fails in the ways that matter: batches arrive faster than attachments can be found, and the day a retailer or auditor asks for a specific COA, the answer is a search through years of mailboxes.
- The infrastructure answer is one SFTP endpoint: each lab, manufacturer, and supplier drops documents into their own folder per batch, and the brand holds a dated, logged, instantly retrievable trail for every SKU.
- On managed SFTPGo hosting that document backbone is €9 a month with unlimited supplier accounts, with the small per-batch PDFs staying far inside the included storage for years.
The paper trail behind every batch
A consumer health brand's compliance life runs on documents it does not produce itself. The contract manufacturer holds the specification. The testing lab issues the certificate of analysis for each batch. Suppliers provide raw-material documentation. Packaging carries its own declarations. None of it originates with the brand, all of it belongs to the brand, and any of it can be demanded later: by the marketplace during a compliance review, by the retail buyer during onboarding, by an insurer, or by a regulator tracing a batch.
The operational question is never whether the documents exist; they do. It is whether the brand can produce the right one, for the right batch, quickly. Email intake makes that a lottery: certificates land in inboxes and download folders, named by whatever convention the sending lab preferred that week, attached to threads that leave with the employee. The pattern that fixes it is the same structured intake any high-document industry uses, pointed at the brand's supplier network.
The document lanes, one endpoint
| Document lane | Direction | Counterparty | Cadence |
|---|---|---|---|
| Certificates of analysis | In, per lab, per batch | Testing labs | Per batch |
| Specifications and manufacturing docs | In, per manufacturer | Contract manufacturers | Per product and revision |
| Raw-material and packaging documentation | In, per supplier | Ingredient and packaging suppliers | Per lot and change |
| Retailer and marketplace compliance packs | Out, per channel | Retailers, marketplaces, insurers | On request |
| Distribution and fulfillment files | Both, with the 3PL | Fulfillment partner | Daily |
Each counterparty gets one account and one folder tree: per lab, per manufacturer, per supplier, with batch-named subfolders the brand defines once. The web client covers the suppliers without software: the lab's administrator opens a browser, signs in, and drops the certificate onto the batch folder. Larger partners with document systems connect with standard SFTP automation. Either way, the document lands in a named, dated, logged place.
Batch traceability as a side effect
The quiet payoff of structured intake is retrieval speed. When a marketplace review asks for the COA of a batch shipped eight months ago, the answer is a folder listing, not an email archaeology project: batch folder, certificate, upload timestamp, uploading account. The audit log doubles as an internal control, because it shows not only what arrived but when and from whom, which is precisely the chain a compliance conversation asks to see.
Retention stops being a decision made by mailbox policies. Documents stay for as long as the brand's own retention policy says, in folders that mirror the batch structure, and the storage math is kind: certificates are pages, not gigabytes, and years of them sit comfortably inside a small allowance. For the heavier neighbors of the document trail, artwork masters and product photography, the same endpoint carries them on the media lanes described in the ecommerce brand's exchange map.
Outbound: the compliance pack on demand
The same structure answers outbound requests. A channel's reviewers get access scoped to the documents they have asked for, through their own account or a one-time secure link with an expiry; the brand controls exactly which certificate or specification each requester sees, and the log records every download. Wholesale and retail buyers receive onboarding packs the same way, which keeps the sales-side promise of fast compliance response a matter of folder permissions rather than a scramble.
This mirrors, from the brand's chair, the patterns in the sibling pieces: wholesale distributors running price lists and invoices over the same lanes, and SaaS products offering their partners a structured ingest endpoint. The transport is identical; only the documents differ.
Sensitivity, stated precisely
Certificates and specifications are commercially sensitive and, in aggregate, describe a supply chain the brand may prefer competitors not to map. The endpoint's protections are concrete: per-account isolation, so each lab and manufacturer sees only their own lane; encrypted transfer; per-user logging of every upload and download; and two-factor authentication on the administrative side. Proprietary formulation details, where they exist, live in documents the brand can scope to internal-only folders. The endpoint is access control for documents the brand already controls, which is the correct shape for this sensitivity class.
What the document backbone costs
The account count for a supplement brand is its supplier network: a few labs and manufacturers, ingredient suppliers, packaging, a 3PL, and the channels that request packs. The flat lane prices the instance rather than the roster: €9 a month, unlimited accounts, 30 GB included, with certificates and specifications consuming megabytes per year. The market's per-user alternatives, compared tier by tier, are covered in managed file transfer pricing compared, and what running the underlying server costs on every path, including the free self-hosted one, is the real cost of running SFTPGo. Operational setup for the folder patterns in this piece is step by step in the SFTPGo knowledge base.
Frequently asked questions
What is a certificate of analysis?
A document a testing laboratory issues for a production batch, recording the tests performed and their results for that specific batch. Supplement and consumer health brands collect one per batch from their labs, and retailers, marketplaces, and auditors routinely request it during onboarding, reviews, and trace checks.
How do labs deliver certificates over SFTP?
Each lab gets an account and its own folder tree organized by batch: the lab's administrator signs into the web client in a browser and drops the certificate onto the batch folder, or their document system connects with standard SFTP automation. Either way the file lands dated, named, and logged.
Why is email the wrong lane for batch documents?
Because retrieval fails exactly when it matters: certificates scatter across inboxes and download folders under whatever name the sender chose, threads leave with employees, and producing one batch's document months later becomes archaeology. Structured intake makes retrieval a folder listing with an upload timestamp and an account name attached.
Can we hand a retailer only the documents they requested?
Yes. Access is per account and per folder: a channel's reviewer gets visibility scoped to exactly the pack requested, through their own account or a one-time secure link with password and expiry. Every download is logged, and nothing outside the scoped folder is visible to them.
How fast can we answer an auditor's batch request?
As fast as a folder listing: batch folder, certificate, upload timestamp, uploading account. The audit log is the internal control an auditor asks to see, showing when each document arrived and from which counterparty account.
Who else in the supply chain connects?
Every document counterparty: testing labs, contract manufacturers, ingredient and packaging suppliers, the fulfillment partner's daily files, and the channels that request compliance packs. Each gets one account and one lane; the brand's virtual-folder view maps every lane into one pane.
How long can documents be retained?
As long as the brand's own retention policy requires: retention is a folder decision, not a mailbox policy. Certificates are small PDFs, so years of batches sit inside a modest storage allowance, and the storage beyond the included amount is metered transparently.
Are our specifications safe from other suppliers?
Isolation is per account: each lab and manufacturer sees only their own lane, never another counterparty's documents. Transfer is encrypted, every access is logged, and formulation-sensitive documents can be scoped to internal-only folders entirely.
Does this replace our quality management system?
No, and it is not meant to: the QMS remains the system of record for processes and decisions. The endpoint is the transport and the vault for the documents themselves, and structured intake makes sure the QMS's evidence base is complete, dated, and instantly producible.
What if a supplier cannot use anything but email?
The bridge is human minutes: the brand's team drops the received document into that supplier's lane from the web client, so the archive stays complete and uniformly structured while the supplier catches up. The folder structure does not change when the last supplier joins the automated lane.
How is this priced for a brand with many suppliers?
On the flat managed lane, €9 a month for the instance with unlimited supplier accounts and 30 GB included; batch documents consume megabytes per year. Per-user services bill the supplier roster instead, which prices the brand's network rather than its data.
Does the brand need its own server administrator?
The managed lane exists so the brand does not need an operator: updates, daily backups, monitoring, and support are included, and folders and accounts are managed from a web admin. Self-hosting the same open-source software is free, with operations becoming the brand's job; every path is priced in the linked comparison.
Sources
- Feature set: per-user isolation, web client uploads, secure share links, audit logging, quotas: github.com/drakkan/sftpgo README (viewed October 2026)
- Batch-document pattern (per-batch certificates from labs, retailer compliance requests, traceability): standard consumer goods quality practice, observed October 2026
- Pricing and inclusions: danian.co/sftpgo and danian.co/pricing
