tagħtux ghalibkum ċertifikat jew score fuq il-kumpanija tiegħi

Aħna ma nagħtux ċertifikat, punteġġ jew opinjoni

Nee, we do not, and that is an intentional boundary. Supplia does not provide a mark, a rating and no statement about your business. What you set up in the chain file are facts and the supporting documents that belong to them — no evaluation of those facts. The distinction that is often confusing: ISO/IEC 27001 certification is a judgment of a certifying body about your information security, based on the control measures in Annex A. We only record whether you have that certificate and make the certificate itself available as evidence. We do not confirm that it is correct, we do not check its validity, and we do not express an opinion on the quality of your security.

The same applies to any other subject where a questionnaire seems to ask for assessment. For the ten measures of article 21 paragraph 2 of the NIS2 Directive (2022/2555) you fill in what you have organized — we do not assess whether that is sufficient for your sector or risk profile. For a VSME report according to the basic module of EFRAG, the same applies: we structure the data that the standard requests, but we do not determine whether your report is "good" or "CSRD-proof". That assessment lies with the customer who sends out the list, with an auditor, or with a certifying body — never with us. If supporting documentation is missing, the answer remains open; we never fill in an assessment where there is no source document for it.

That which we record comes from the trade register and your own file

The basic data we use for identity — such as l-isem statutorju u in-numru ta' reġistrazzjoni — come from the registration that the Trade Register Act 2007 already requires. For subjects such as ISO 9001 or continuity planning, the same procedure applies: we show what you have submitted, with source reference, so that you can confirm each answer with yes or no. The assessment of that content lies with the person who asks for it.