DPP software and supplier certifications
Which DPP software is suitable for managing supplier certifications?
How to clarify your data and evidence workflows before integration and retain control when choosing DPP software.
For managing supplier certificates, I would choose DPP software that lets your company assign evidence to the right records, trace changes and control how information is shared. You can only judge which platform does this best for you once your own process is clear.
That is why I would look at an existing certificate before the first demo. Where does it come from? Which parts does it cover? Who has reviewed it? If those questions remain unanswered, you also lack the criteria you need to assess an offer.
First, understand what your data says
Consider a hypothetical supplier with several sites. Purchasing has stored a current certificate. The product database links every part from that supplier to it. The certificate, however, only covers one site.
A new tool can import that link. The import completes and every required field is filled in. Yet the link is still incorrect for some of the products.
This is why, for me, work on the data comes before integration. A supplier, a site, a material and a batch are different points of reference. Your team needs to establish which of them a certificate covers.
I would choose one product area and bring purchasing, quality management and IT together. A simple overview is enough to start with:
- What evidence is available, and who issued it?
- Which supplier, site or product does it cover?
- How long is it valid, and what is its review status?
- Which system holds the authoritative information?
- Who reviews, approves and requests updates?
This lets you resolve duplicate supplier identifiers, conflicting links and outdated document versions. Missing information stays visible. It should not be filled in with unsupported assumptions during import.
You do not need to clean up the entire dataset first. One small, complete process already shows where information is missing and where someone needs to make a decision. Data availability, reliable information and cooperation along the supply chain are among the known challenges in DPP initiatives. I would plan for that work from the start. (DPP use cases and implementation challenges)
What your company should be able to control
By control, I mean that your team understands the process and can change it. It should be able to trace where information came from, who approved it and which recipients receive it.
For me, that requires a suitable data model, a traceable version history, access permissions at the right level and interfaces to existing systems. Each of these functions needs to be tested with your own data.
| Area | What I would check before buying |
|---|---|
| Data model | Can your team adapt the required fields and relationships itself? |
| Approvals | Can responsibilities, decisions and previous data states be traced? |
| Suppliers | Can they submit and renew certificates, and can your team see outstanding responses? |
| Sharing | Can you define recipients, the information shared and access permissions? |
| Changing providers | Can documents, metadata, relationships and history be exported in a usable form? |
Ask which changes your team can make itself and which require help from the software provider. This affects ongoing effort and part of the cost.
For an export, a downloaded file alone would not be enough evidence for me. I want to check whether documents and records can be matched up again outside the platform. Otherwise, an export exists technically, but whether it makes a provider change practical remains unclear.
Keep technical verification and suitability separate
Cryptographically verifiable evidence can help when information is exchanged between companies. What matters is exactly what is being checked. A verifiable signature answers a different question from whether a certificate applies to a product. The W3C Verifiable Credentials standard also distinguishes between verifiability and the truth of the claims made.
Your process therefore needs clear rules: Which issuers do you accept? Who assesses the scope of a certificate? How does your team learn that it has been revoked? What happens if an update does not arrive?
Whether a case requires a follow-up question, a new review or a block needs to be decided by the people responsible for the process. The software should support that decision in a traceable way. Your company must separately establish which evidence is legally required for its products and how it must be assessed.
I would also record who may approve an exception and how that decision is documented. Otherwise, the next review may leave you unable to explain why a certificate was used despite an unresolved detail.
Give software providers a complete process to work through
With this preparation, you can select candidates more deliberately. As an initial direction, I would take a closer look at VERA by Spherity for questions about cryptographically verifiable evidence and greenable for structured data management. A DPP market overview can help you identify further candidates.
This is not a ranking. Software providers understandably describe the strengths of their own products. Published feature descriptions and individual user ratings are not enough for me to identify a reliable overall winner. I have not tested the products myself for this purpose.
Give the candidates the same approved sample data: a valid certificate, an expired one, a revoked one, an incorrect link and an updated version. Walk through the whole process: receipt, review, approval, sharing and export.
Also check what already happens in existing systems. If quality management already approves a certificate, it needs to be clear how that status reaches the product passport and what happens when it changes. A second approval maintained independently would create additional coordination work.
After the test, you should be able to say what works automatically, where people need to decide and what ongoing work remains. Alongside license fees, compare data cleanup, integration, training and ongoing maintenance. The result is a reasoned shortlist with open questions you can resolve before investing.
What needs to be clear before building the interface
My work on FluentAAS focuses on technical data modeling. The library can be used to create, validate and export Asset Administration Shell models in C#. Whether a certificate is factually correct and may be used requires additional checks.
This connection between existing data, its relationships and a usable interface is also where my technical DPP preparation for existing .NET systems starts.
For your selection process, I would begin with one product area and a complete evidence workflow. You can then show a software provider exactly what data is available, which decisions your team makes and what the software needs to take on. That also leaves you in a position to judge the result yourself.