Supply chain transparency portal launched — supplier audits visible to clients

Name: Merch.com.ge
Address: GE

A client-facing portal that surfaces real-time supplier audit reports (BSCI, Sedex), ISO certificates, OEKO-TEX and GOTS documents, CO2 footprint and audit-trail breadcrumbs for every active programme.

Request portal access Sustainability programme

What the portal is and what it is not

The supply chain transparency portal is a per-client view into the supplier network that produces the buyer's merchandise. Each buyer who has an active programme with us receives portal access for the duration of the programme plus 24 months afterwards. The portal shows, for each supplier used by the programme, the supplier name, the supplier location, the supplier's audit certificates (BSCI, Sedex, ISO 9001, ISO 14001, ISO 45001), the supplier's product certifications (OEKO-TEX Standard 100, GOTS, GRS, FSC, RCS), the supplier's last audit date, and the next scheduled audit date. For GOTS and GRS programmes the portal surfaces the transaction certificate index with the certificate number, the buyer name, the certificate date, the SKU volume and the issuing certification body.

The portal is not a public registry. It is not a marketing tool. It is not an open-data initiative. The data is commercially sensitive (it includes the supplier pricing we negotiate, the volume commitments we make, and the supplier identities that we have spent years qualifying) and we owe confidentiality to our suppliers as well as to our buyers. The portal is therefore per-client, behind authentication, and the access is read-only. A buyer who needs additional data — the supplier's last audit report in full, the energy-bill index for the energy pillar of the EcoVadis score — requests it under NDA and we share it inside 5 working days.

The portal is also not a substitute for our own internal supplier-management system. The internal system tracks every supplier, every audit, every certificate, every non-conformance, every corrective action, every supplier meeting and every supplier visit. The portal surfaces a curated, buyer-facing subset of that data. The internal records are retained for 7 years (the standard supplier-records retention period for a regulated B2B producer) and are available to buyers under NDA on request.

Why transparency matters for a B2B merch supplier

Corporate merchandise sits at the seam between marketing, HR and procurement. Procurement increasingly requires evidence-based supplier disclosure — the supplier cannot be a black box that the marketing team chooses and the HR team trusts on faith. The CSRD supplier-engagement pillar is the regulatory version of that requirement; the UK Modern Slavery Act is the supply-chain version; the EU CSDDD is the due-diligence version; the US Uyghur Forced Labor Prevention Act is the import-control version. Each regime asks the same question: can you show me the supplier?

The portal is our answer. A buyer who needs to answer "where was this polo made?" in front of their own procurement committee, their own board, their own auditor or a regulator can open the portal and see the chain: the cotton farm, the spinning mill, the knitting mill, the dyeing partner, the cutting-and-sewing partner, the QA inspector, the shipment. The answer is a series of indexed, time-stamped, third-party-verified documents rather than a verbal assurance.

The portal also helps with the procurement audit itself. A buyer who is themselves subject to CSRD has to file an annual supplier-disclosure return; the portal data is a ready-made input to that return. The EcoVadis scorecard and the supplier audit certificates feed the supplier-environmental and supplier-social pillars of the buyer's double-materiality assessment; the CO2 footprint data feeds the Scope 3 emissions disclosure. We do the data work once on our side and the buyer reuses it across their own disclosure obligations.

What the data looks like in practice

For a typical 500-unit organic cotton polo programme the portal shows the buying organisation's name, the programme reference, the SKU description, the volume, the destination market, and the production timeline. For each of the five upstream partners (cotton farm, spinning mill, knitting mill, dye-house, cut-and-sew) the portal shows the partner name, the partner location, the certification status (BSCI grade, Sedex SMETA audit date, ISO certificates, OEKO-TEX Standard 100 for the dye-house, GOTS transaction certificate for the cotton), the last audit date, and the next scheduled audit. The GOTS transaction certificate itself is downloadable as a PDF with the certificate number and the issuing body (Control Union in most cases, ICEA in some cases, ECOCERT in others).

For a stainless-bottle programme the portal shows the bottle blank supplier (typically the Ningbo or Shenzhen partner), the laser-engraving partner (our own Tbilisi workshop), the packaging supplier (the FSC-certified box supplier in Kutaisi), the QA inspector, and the courier. The audit certificates for the bottle blank supplier are typically BSCI grade B or above, Sedex SMETA 4-pillar audit, and ISO 9001 + ISO 14001. The QA inspection reports for each batch are downloadable as PDFs and show the AQL 2.5 inspection result, the lot size, the sample size, the defect count and the disposition.

For a multi-component welcome kit the portal shows the same data per component, indexed to the kit-level programme. The buyer who needs a kit-level audit summary receives one as a single PDF with the per-component drill-down attached; the buyer who needs a SKU-level trace receives the GOTS or GRS transaction certificate directly. The granularity is per-component because that is what procurement audits ask for; the kit-level rollup is a convenience for the executive sponsor who just wants to know "are we OK?"

Who can access the portal and how

Access is granted per buying organisation. The buyer's procurement contact nominates up to five individuals to receive portal access; each individual receives an email invitation with a one-time link to set a password. The portal uses the Cloudflare Turnstile-protected form on the buyer's own procurement-side identity — we do not run our own identity provider, we federate through the buyer's existing SSO where possible (Okta, Azure AD, Google Workspace, Auth0). For buyers without an SSO we issue per-individual credentials with hardware-key MFA (YubiKey or equivalent).

Access is read-only and audit-logged. Every portal view is logged with the individual, the timestamp, the data accessed and the IP address. The audit log is held for 12 months and shared with the buyer's procurement contact on request. A buyer who needs a user removed (for example because the individual has left the buying organisation) sends a one-line email and the access is revoked inside one working hour.

The portal is accessible at portal.merch.com.ge over HTTPS with HSTS preload, TLS 1.3 minimum, and a certificate pinned to the standard Cloudflare Origin certificate chain. The portal itself runs on a Tbilisi-based VPS with NGINX, PHP-FPM and a PostgreSQL backend; the database is encrypted at rest with LUKS and the backups are encrypted in transit to a Georgian-based backup provider.

Frequently asked questions

How does a buyer get access to the supply chain transparency portal?

The buyer's procurement contact nominates up to five individuals, each receives an email invitation with a one-time link to set a password. The portal federates through the buyer's existing SSO where possible; for buyers without an SSO we issue per-individual credentials with hardware-key MFA.

Is Corp-Merch affiliated with BSCI, Sedex, OEKO-TEX, GOTS or any certification body?

No. BSCI, Sedex, OEKO-TEX, GOTS and similar bodies are independent third-party audit and certification organisations. We source from BSCI-audited and Sedex-audited suppliers and use OEKO-TEX-certified and GOTS-certified materials; we are not a partner, sponsor or affiliate of any of them.

Can the buyer download the underlying audit reports?

The portal surfaces the certificate index and the certification status per supplier. The full audit reports are available on request under NDA; we share the report inside 5 working days of the request.

How long is the portal access retained after the programme ships?

Portal access is retained for 24 months after the programme ships. For longer retention projects (well above 24 months), the access is renewed on request and the data is retained in the portal until the buyer asks us to delete it under the GDPR right-to-erasure.

Corp-Merch is an independent corporate merchandise producer in Georgia. We are not a partner, sponsor or official supplier of BSCI, Sedex, OEKO-TEX, GOTS, FSC, any certification body, conference, awards body, association or government body named anywhere on merch.com.ge.

Request portal access

Send the procurement contact, the buying organisation and the programme reference. We will reply within two working days with a portal-access invitation for the nominated individuals.