Records a defence customer can audit, without an IT department
Larger defence buyers are opening their supply chains to smaller engineering firms. Winning the work is the first step. Keeping it means showing, when asked, what was checked, by whom, and what has changed since.
Buyers are opening their supply chains to smaller firms
Today, around four percent of UK defence spend goes to SMEs. The large buyers at the top of the supply chain want that share to grow, and some are changing how they buy to make it happen: opportunities that are easier to find, contracts sized to the supplier, prompt payment, and help meeting defence standards.
That is an opening for remanufacturers, overhaul shops, precision engineers, and casting and machining firms who have the capability but have never been on a defence supplier list.
The catch comes after the contract. A buyer used to auditing large suppliers will expect the same of a small one: records produced by a system, tied to a person, and ready when asked for. In most small firms those records are paper inspection sheets, a spreadsheet, and the memory of whoever filled them in.
What they will expect of your records
None of this is new to a quality manager. It is what ISO 9001 clause 7.5 and AS9100 call documented information, and it is what a customer audit tests. The difference is that a defence customer will now expect it of you, not only of its larger suppliers.
Tied to a person
Every record shows who made it and when. A result nobody can put a name to is an opinion, not evidence.
Changed only with a reason
A signed-off record changes only with a recorded reason, and the change itself is kept. Nothing is quietly overwritten.
Produced again as it stood
Any version of a record can be produced again exactly as it was, including the copy your customer was sent.
Ready when asked
When the customer asks about one unit, you search for its serial number or job reference and send the record, rather than going through a filing cabinet.
Every action on record
Every action is written to an insert-only audit log, and each report's revision history is printed on the report and its PDF.
Cyber-security conditions are a separate question
Defence contracts can also carry cyber-security conditions. These concern the systems your records are kept in, not what the records say, so they sit alongside quality records rather than replacing them.
Which conditions apply to you depends on your contract and the information you handle, and your customer will tell you. Our security page sets out how TraceID is hosted and protected.
Cyber-security controls
Supports the controls a defence supplier needs under DEFCON 658 and DEF STAN 05-138: role-based access, single sign-on, an insert-only audit log, encrypted storage in the UK, and controlled revisions with a recorded reason.
What that looks like without an IT department
TraceID Verified is an inspection system we host for you on AWS in London. It runs in the browser on an iPad or a laptop, so there is no server to buy and nothing to maintain.
We set up your first form
Bring the inspection sheet you use today. We build it with you as a Verified form, with your checks in your order. Your team can change it later in the Form Builder.
Inspectors record at the bench
Inspectors work through one section at a time on an iPad, taking photos on the same device. Mandatory fields block progress, and every answer saves as it goes.
Rules decide the result
Status fields carry Red, Amber or Green. Calculated fields check readings against a tolerance, and the report takes the worst status present.
Every report gets an automatic job reference, such as DEMO-000054. Identifiers you choose, such as the serial number, are pinned to every step and printed on every page of the PDF.
Your team signs in with email and password, a six-digit email code, or Google or Microsoft single sign-on. Four role levels control who can do what.
Proof your customer can read
Your customer does not need an account. They get a branded PDF: your logo, the photos taken at the bench, the result of every check, and the unit's identifiers as a running header on every page. You email it from the app, and every send is logged.
When a record changes
A signed-off report is never edited in place. A correction is made on a working copy and cannot be committed without a reason. Verified records the field-level difference, every earlier revision can be produced again as its own PDF, and anyone who was sent an out-of-date copy is flagged.
When an auditor asks
Reports are archived with a reason, never deleted. An insert-only audit log records every action with its time, IP address and request ID.
This is in production use. A UK steering-box reconditioning shop has recorded its inspections on Verified since December 2025.
Start before the contract, not after
A records system proves itself with history. When a customer audits you, they ask about units you finished months ago, not the one on the bench today. A system started the week the contract is signed has nothing behind it.
Starting early also gives your team time to settle the form. Forms are versioned: when you change one, reports already in progress finish on the version they started, so you can refine the checks as you learn without disturbing live work.
Pick one inspection you run today. We will show it to you as a Verified form, and you can decide from there.
Have the records ready before the first audit
Bring one inspection sheet. We will show it to you as a guided form with rules, photos, controlled revisions and a PDF your customer can read.