A supplier portal is a secure external workspace for the people outside your company who have to review, approve or answer: customer reviewers and sub-tier suppliers. Each one sees only what you share with them and does the task you ask of them, on the live record rather than on a copy attached to an e-mail.
Automotive quality work depends on this exchange in both directions. IATF 16949 expects an organisation to control its external providers. The AIAG PPAP manual, 4th edition, ends with the customer's disposition on the Part Submission Warrant (PSW). AIAG APQP tracks supplier readiness, and second-party audits such as VDA 6.3 end with findings the supplier has to answer.
Zometric Supplier Portal handles nine kinds of task: review a Control Plan, a PFMEA or a PPAP submission; complete a checklist; submit PPAP elements; provide pass-through characteristic (PTC) data; respond to an action; answer an 8D from D3 to D6; and respond to an audit finding. External people are not users of your system. A link opens a separate portal session that cannot reach any internal page.
Six problems supplier quality teams describe in their own words, and what changes when customers and suppliers work on the same record.
Every task follows the same path: share a record, ask for one thing, accept the answer.
Step 1 · Contacts
Add each customer reviewer or supplier contact to their party with a name and e-mail address. A record that belongs to a customer or supplier can only be shared with that party's own contacts.
Step 2 · Share
Pick the Control Plan, PFMEA, PPAP submission, checklist, supplier CAPA, audit finding, PTC, action or part, and set what the contact may do: view, comment, approve or download. A share can be black-box, with hidden columns and an expiry date.
Step 3 · Request
Give the task a title, a due date and a message. Some tasks are created for you: submitting an outgoing PPAP opens a review task for each active customer contact, and issuing an APQP checklist to a supplier opens a checklist task.
Step 4 · Link
The contact receives a link to the task, valid for 7 days by default. The portal session ends after 30 minutes without activity or 12 hours at most, and the contact can request a 15-minute sign-in link at any time.
Step 5 · Answer
A customer decides row by row or element by element. A supplier answers checklist items, uploads evidence, or fills the 8D steps. Drafts are saved until the contact submits.
Step 6 · Sign
Control Plan and PPAP decisions need the contact's full name and a re-authentication: a link opened within the last 15 minutes, or a six-digit code by e-mail, valid for 10 minutes.
Step 7 · Accept
Accept each answered item or 8D step, or return it with a comment saying what is missing. An answer task completes when every item or step is accepted, and every action stays on the portal timeline.
Each capability is tied to a decision your team is already trying to make.
No username, no password, no onboarding session. An external contact opens a link and sees only the tasks addressed to them. Links expire, can be revoked, and never open anything inside your internal system.
Your customer's reviewer approves or rejects row by row or element by element and, on a PPAP, records the warrant disposition, including an interim approval. Control Plan and PPAP decisions are e-signed with a typed name and a fresh link or one-time code, and written straight into the plan's customer approval or the PPAP submission; a PFMEA review is recorded on the FMEA.
Request PPAP elements, APQP checklists or ad-hoc evidence from a sub-tier supplier. They answer item by item; you accept or return each one. Supplier readiness stops being a status you chase by phone.
Send a supplier the containment, root cause, corrective action and implementation steps (D3 to D6) of an 8D, or a finding from a second-party audit. 8D steps enter your CAPA only after your engineer accepts them; a finding response goes to the auditor's accept-or-reject decision.
Share a PFMEA or Control Plan without giving away the know-how. Hidden columns are removed before the page leaves the server, every view carries a watermark naming the viewer, and download and print are disabled.
Every link opened, document viewed, answer submitted and decision signed is on one timeline — who, when and from where. Overdue tasks and answers waiting on your side are counted on the portal home.
Every open task is compared with today's date. A task due in two days or less is flagged due soon, and one past its due date is overdue. A daily job e-mails a reminder with a fresh link when a task is exactly two days from due, and an overdue notice every day after the due date, at most once per day.
| Task | Due | Flag | Reminder e-mail |
|---|---|---|---|
| Review Control Plan | Due20 Oct (in 8 days) | FlagNone | Reminder e-mailNone yet |
| Submit PPAP elements | Due14 Oct (in 2 days) | FlagDue soon | Reminder e-mailReminder sent today |
| Complete checklist | Due13 Oct (in 1 day) | FlagDue soon | Reminder e-mailNone today; sent on 11 Oct |
| Answer 8D | Due9 Oct (3 days ago) | FlagOverdue | Reminder e-mailOverdue notice, every day |
| Respond to audit finding | Due8 Oct (completed) | FlagNone | Reminder e-mailNone |
The portal has no copy of its own. Each answer is written back through the module that owns the record.
Submitting an outgoing package opens a review task for the customer. Element decisions and the warrant disposition are written into the submission, and a sub-tier supplier's evidence is added to the elements of an incoming PPAP.
A CAPA with a supplier can request an 8D answer. Accepted D3 to D6 steps become containment actions, root causes, corrective actions and completed implementations in the CAPA.
A customer's review sets the Control Plan's customer approval, and a supplier's accepted answers update its pass-through characteristic records.
Customers see a summary or a read-only view of the PFMEA, black-box if you choose, and their review is recorded as a comment on the FMEA.
A checklist issued to a supplier becomes a portal task, and the supplier's answers are written into the live checklist, which is submitted once it is complete.
The supplier's response to a second-party audit finding goes straight to the finding, where the auditor accepts or rejects it.
Register contacts, share Control Plans, PFMEAs, PPAP submissions and checklists, create tasks, issue links, and accept or return answers.
Request a supplier's 8D answer on a CAPA and accept or return each step before it enters the case.
Request a supplier's response to a second-party audit finding, then accept or reject it on the finding.
Sees the portal home, the task register and the external activity timeline.
Review shared Control Plans, PFMEAs and PPAP submissions, comment, and sign their decision.
Answer checklists, PPAP evidence requests, PTC data, actions, 8D steps and audit findings, with file uploads.
| Zometric Supplier Portal vs e-mail and shared folders | E-mail and shared folders | Zometric Supplier Portal |
|---|---|---|
| Access | Attachments forwarded, folder accounts to manage | A personal link to one task; no account, no internal page reachable |
| What is shared | The whole file, which can be forwarded | A scoped share; hidden columns removed on the server for black-box views |
| Customer approval | A signed PDF or a reply e-mail | Element decisions and an e-signed warrant disposition written into the submission |
| Supplier 8D | A PDF retyped into the CAPA | Structured D3 to D6 steps, accepted one by one into the CAPA |
| Evidence files | Inbox attachments, unchecked | Uploads per item, type-checked and malware-scanned before anyone opens them |
| Follow-up | Chasing by phone and calendar | Due-soon and overdue flags, reminder e-mails and a "waiting for us" count |
| Withdrawing access | A sent e-mail cannot be recalled | Revoke a share or let it expire; its open tasks are cancelled |
| Audit trail | Spread across mailboxes | One timeline of every view, answer and decision, with time and IP address |
Task invitations and reminders carry a fresh personal link, and the requester is told when a contact records a decision. Mail goes through your SMTP settings.
PDF, Excel, CSV, Word, image and text files up to 25 MB, stored with a SHA-256 checksum and scanned before they can be opened.
External contacts, shares, review tasks and supplier 8D answers are available through the REST API, including revoking shares and accepting or returning 8D steps.
Straight answers to the questions teams ask before a demo.
No. Each external contact gets a personal link to their task, valid for 7 days by default. The link opens a separate portal session that shows only the tasks addressed to that contact and cannot reach any internal page. A contact can also request a single-use sign-in link, valid for 15 minutes, from the portal's sign-in page.
Yes. The customer's reviewer approves or rejects each element, can approve all remaining elements in one step, and records the warrant disposition: approved, rejected, interim approval or other. An interim approval requires the non-compliances, action plan, containment, re-submission due date, and an expiry date or authorised quantity. The decision is e-signed and written into the PPAP submission.
The contact types their full name, which must match the contact record, and re-authenticates: either the portal session was opened from a link in the last 15 minutes, or they enter a six-digit code sent by e-mail and valid for 10 minutes. The signature records the name, e-mail address, party, meaning, statement, time, IP address and a SHA-256 hash of what was signed.
No. The supplier fills D3 containment, D4 root causes, D5 corrective actions and D6 implementation, but nothing changes in the CAPA until your engineer accepts a step. Accepted steps are written into the CAPA, marked as coming from the supplier. A returned step goes back to the supplier with a comment saying what is missing.
Yes. A black-box share removes the columns you hide before the page leaves the server. By default these are the work element, prevention controls, occurrence, detection controls and detection. Every page carries a watermark with the viewer's e-mail address and the time, printing and downloads are disabled, and each view is logged. You can also share only a summary of the FMEA.
PDF, Excel (xlsx and xls), CSV, Word (docx), PNG, JPEG, TIFF and text files up to 25 MB each, with at most 10 files per item. Archives and CAD files are not accepted, and a renamed file is detected from its content. Every file is malware-scanned, and nobody can open it until the scan is clean.
Nine kinds of task: review a Control Plan, a PFMEA or a PPAP submission; complete a checklist; submit PPAP elements; provide pass-through characteristic data; respond to an action; answer an 8D from D3 to D6; and respond to a second-party audit finding.
Yes. A share can be revoked at any time, which cancels its open tasks, and it ends on its own at its expiry date or when the contact is deactivated. Expired or revoked links show a message instead of the task.
A 30-minute discovery call. A 2–3 week pilot on real factory data. Then scale at your pace.
