External Document Upload

EQMS provides a secure portal for external parties to upload documents without needing a full user account. Use it to collect certificates, audit reports, quality agreements, and other compliance documentation from suppliers, auditors, and contractors.

---

How the external upload flow works

1. An EQMS user generates a unique upload link with an associated token.
2. The external party receives the link and a 6-digit verification code via email.
3. The external party verifies their identity and uploads the requested documents.

---

Generate an upload link (EQMS user)

Upload links are managed per supplier, on that supplier’s own record.

1. Open the supplier’s record (Suppliers → select a supplier).
2. Select the External Upload tab.
3. Select Invite a contact.
4. Enter the Recipient email and Recipient name, and optionally a Purpose (for example, “Annual Supplier Requalification 2026”).
5. Select Send invitation. The link and a 6-digit verification code are emailed to the recipient automatically.

The tab lists every invitation sent for that supplier, its status (Active, Expired, Revoked), and how many uploads have been used against its limit. Select Revoke on an active invitation to disable it before it expires.

Note

Generating and revoking invitations requires the Suppliers — Admin permission, since an invitation grants an external party a real (if scoped and time-limited) upload capability against the supplier record.

---

Verify your identity (external party)

1. Open the upload link received via email.
2. On the verification screen, enter the 6-digit verification code sent to your email.
   • Type each digit in the individual digit fields (focus advances automatically).
   • Or paste the full 6-digit code at once.
   • Use Backspace to navigate between digit fields.
3. Select Verify Code.

Caution

The verification code is required for every upload session. If the code is not received, check your email spam folder or contact the QA team.

Repeated verification attempts (right code or wrong) are rate-limited by both the link and the caller’s network address, on top of the existing attempt-count lockout. This is a security control against code-guessing and does not affect a legitimate external party entering their real code.

---

Upload documents (external party)

After verification, the upload portal shows a welcome message with your name, the purpose of the upload request, uploads remaining, and the link expiry date.

Upload a document

1. If specific document types were requested, review the checklist showing which have already been uploaded.
2. From the Document Type dropdown, select the type of document. If the link requested specific document types, exactly those are offered (plus a catch-all Other); otherwise a generic list is offered instead:
   • GMP Certificate
   • ISO 13485 Certificate
   • ISO 9001 Certificate
   • Audit Report
   • Quality Agreement
   • Supplier Questionnaire
   • Manufacturing License
   • Certificate of Analysis
   • Stability Data
   • Validation Report
   • Other
3. Enter the Document Title. This is required — it is the name the QA team sees for the document in the register, so use something specific such as “ISO 13485 Certificate 2026”.
4. Optionally, enter the Issuing Authority (for example, FDA, BSI, TUV).
5. Set the Issue Date. This is required. Optionally, set the Expiry Date — the system uses it to flag the document as expiring or expired.
6. Select a file to upload. Each upload link can carry its own, narrower file-type and size policy, set by the QA team member who generated it — the portal shows and enforces that link’s actual limits. Unless narrowed, the default is PDF, DOC, DOCX, XLS, XLSX, JPG, PNG (maximum 50 MB per file). A file outside the link’s allowed types, or over its size limit, is rejected with a message naming what is actually accepted.
7. Submit the upload.
8. The uploaded file appears in the Previously Uploaded Files list below the form.

Note

Upload Document stays disabled until the document type, title, issue date and file are all supplied. The portal lists whatever is still missing directly above the button.

Uploads through a single link are rate-limited by both the link and the caller’s network address, on top of the per-link upload count limit. This bounds abuse of the upload endpoint itself and does not affect normal use — a legitimate external party filing several requested documents in one session will not encounter it.

Complete the upload session

1. After uploading all documents, select I’m Done Uploading.
2. A completion screen shows:
   • Confirmation that the upload is complete
   • A summary of all uploaded documents (count, types, file names)
   • An option to Upload More Documents if uploads remain
3. The QA team is notified to review the uploaded documents.

Note

Upload links have an expiry date. Once expired, the portal is no longer accessible. Contact the QA team to generate a new link if needed.

---

External auditor access

A separate flow exists for external auditors who need read-only access to quality records during an audit.

Authenticate and review scope

1. Open the auditor access link.
2. Enter the 6-digit verification code to authenticate.
3. Review the audit scope, including which documents, CAPAs, deviations, and audits are included.

View the storyline and access records

1. Review the storyline timeline showing events with a compliance summary and risk assessment.
2. Access read-only views of the specified resources.
3. Submit audit findings and review disputes as needed.

External auditor sessions:

• Are time-limited (typically 7 days)
• Provide read-only access only
• Log all activities for audit trail purposes
• Allow auditors to submit findings and review disputes

---

Practical example: Requesting supplier certificates for annual qualification

Scenario: A Supplier Quality Engineer needs to collect updated ISO 13485 certificates and GMP audit reports from three critical raw material suppliers as part of the annual supplier requalification process.

1. In the EQMS system, generate three upload links — one for each supplier. For each link, specify:
   • Supplier contact name and email address
   • Purpose: “Annual Supplier Requalification 2026”
   • Requested document types: ISO 13485 Certificate, GMP Certificate, and Certificate of Analysis
   • Expiry date: 14 days from today
   • Maximum uploads: 5 per supplier
2. Each supplier receives an email with their unique upload link and a 6-digit verification code.
3. Supplier A (a sterile packaging manufacturer) opens the link, enters the verification code 482917, and is authenticated. They see the welcome message with the upload purpose and a checklist showing three requested document types.
4. The supplier selects Document Type = “ISO 13485 Certificate,” titles it “ISO 13485 Certificate 2026,” enters Issuing Authority = “BSI,” sets the Issue Date and Expiry Date, and uploads the PDF certificate.
5. The checklist updates to show a checkmark next to “ISO 13485 Certificate.” The supplier repeats the process for the GMP Certificate and a Certificate of Analysis for their latest lot.
6. After uploading all three documents, the supplier selects I’m Done Uploading. The completion screen confirms 3 documents uploaded.
7. The QA team receives a notification that Supplier A has completed their upload. The Supplier Quality Engineer navigates to the Documents module to find the three uploaded certificates ready for review.
8. For Supplier B, who has not yet uploaded after 10 days, the Engineer sends a reminder. The original link is still valid (4 days remaining before expiry).
9. Supplier C’s link has expired. The Engineer generates a new upload link with a fresh verification code.

The external upload portal eliminates the need for email attachments, ensures documents are properly categorized with metadata (issuing authority, dates), and creates an audit trail of when each supplier submitted their certificates.