A custom portal for trade associations, professional bodies, quality marks, training institutes and certification bodies that issue certificates, coordinate audits and supervise members. From application and verification to issuing with a QR code, a public register, renewals and a revocation flow — set up around the rules of your scheme, not those of a generic package.
Those who issue certificates rely on one thing above all: trust. A certificate stands or falls with the credibility of its issuer — and that credibility depends largely on the system underneath. How is it established that an applicant genuinely meets the requirements? Who assessed them, when, and on what grounds? Can a client check for themselves that a certificate is still valid tomorrow? A certification portal manages that entire chain, so the issuing organisation can focus on the substance.
That differs fundamentally from a general web application: a certification portal links the application to an exam or audit, the assessment process to multiple independent reviewers, the outcome to a legally valid issuance, and the certificate to a searchable register. The scheme you operate, whether it is professional certification, a quality mark, an educational certificate or an ISO management system, is the driving force behind the configuration.
We build custom portals for organisations for whom an off-the-shelf package is either too broad or too narrow: an industry body that issues its professional certification and wants to retain control; a quality mark that coordinates audits of its members; an education institute that handles formal diploma recognition; a certification bureau that wants to move its client portal away from an outdated Access environment. We start from the scheme and the rules of your profession, not from a feature list.
The right level depends on your issuance volume, the number of assessors, the severity of compliance requirements (eIDAS, GDPR, accreditation requirements), and the extent to which the system also needs to invoice, integrate and publish. We advise on this during the initial conversation.
A focused portal for a single scheme: candidates or companies register, upload supporting evidence, pay exam or audit fees and, after assessment, receive a digital certificate with a QR code. A simple assessor workspace and a simple public register. Enough to escape from Excel lists and loose PDF certificates.
The rules of your scheme built in: multiple certificates per person or company, exam and audit scheduling, assessment by multiple independent reviewers with conflict detection, renewal cycles with automatic reminders, a complaints and revocation workflow, and a public register on which a client can rely with a single click.
Mission-critical portal for organisations that manage multiple schemes in parallel. Separate scheme data per scheme owner, client portals in your own branding, and integrations with accounting, PSPs, e-signature providers, accreditation bodies and webhook APIs for external registers. Includes eIDAS QES, an anchored integrity hash for public verifiability and a formal handover of management to your IT team.
If you manage amusement or play equipment, each unit carries its own certificate and file. That is what the page on inspection file software for amusement equipment is about.
Regardless of level, we deliver a number of core components as standalone modules, so that you can later scale from a single scheme to a platform without redrawing your architecture.
For a small certification scheme issuing a handful of certificates a year, a spreadsheet and a PDF template are often still workable. We only come into the picture with one or more of the patterns below. During the intake we discuss, without obligation, whether custom development fits — or whether a lighter alternative will suffice.
You'll notice that the requirements of your scheme are interpreted differently in practice by different assessors. A scheme-driven portal enforces the same definitions and evidence requirements for every application, and every assessor works from the same rubric.
For accreditation-compliant certification (ISO/IEC 17024, 17065), independent assessment by multiple reviewers with demonstrable conflict-of-interest controls is a requirement. Off-the-shelf tools rarely handle this well.
You want a contracting authority, training provider or consumer to be able to check for themselves whether a certificate is valid. A PDF on a personal page doesn't achieve that; a searchable register with an API and QR verification does.
Continuing-education points, audit cycles and renewal requirements differ from scheme to scheme. Spreadsheets work up to roughly a hundred certificates. Beyond that, you need a system that keeps the cycle under control.
For trade associations managing more than one scheme, or a platform hosting schemes from different scheme owners: separate data per scheme with central identity and payments. A design decision, not a plugin.
When examination software, payment processing and register publication live in separate tools and your team synchronises them manually every month. One portal that carries the entire chain removes manual work and gives you better management information.
The rules and integrations differ greatly by type of certification. A selection of the contexts for which we have built or advised on certification and register systems.
For trade associations that issue their own trade certification to individual tradespeople, under schemes such as CCV, CKB, KOMO vakmanschap or comparable occupational certifications, we build portals where candidates register, sit theory and practical tests, receive a personal certificate with QES and QR code, and track their continuing-education points. Together with a public register that clients and consumers can consult directly.
For quality marks in ornamental horticulture (MPS), forestry and paper (FSC, FFP), horticulture (GLOBALG.A.P.) and food, we coordinate the entire audit process: annual planning, self-assessments, on-site inspections with mobile data entry, scoring according to the scheme, issuance with a validity date, and publication in an open register that trading partners use to verify provenance and quality.
For training institutes, examination boards and organisations that issue formal diplomas or educational certificates, comparable in scale to CITO or the operational practice of CAOP, we build portals for registration, examination, assessment by multiple independent markers, diploma issuance with QES and integration with DUO or the Diplomaregister. This complements our wider educational app development.
For trade associations and professional bodies that link membership to certification, with continuing professional development requirements, codes of conduct and a supervision and sanctions procedure, we build portals that connect membership, certification and subscriptions. A suspension automatically affects certification, a complaint about a member runs through a structured committee workflow, and the register shows the current status.
For certification bodies that issue company certification based on international management system standards (ISO 9001, 14001, 27001, IATF 16949 for automotive, AS9100 for aerospace), we build client portals for audit planning, certificate history, transfers between bodies, IAF reporting and integration with the accreditation body (RvA). The portal forms the client-facing side alongside your internal audit management system.
For insurance-related certification, where approved repair businesses (Focwa, FCN-style) or assessment firms are periodically audited on quality, environment, safety and customer focus, we build portals that combine the audit cycle, mystery shopper results, customer NPS and claims statistics into a current certification status, with integrations to insurers who act on that status when allocating claims.
Four modules that clients often want to hear more about in a first conversation: how we build them, and why we make some choices differently from a standard package.
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →A no-obligation conversation in which we map out the schemes, estimate issuance volumes, review the compliance requirements (GDPR, eIDAS, ISO/IEC 17024 or 17065, RvA requirements) and determine whether custom development is the right choice, or an existing certification package. Sometimes we recommend the latter; that saves you time and budget.
A working session with your scheme owner, assessors, planners and a few certified professionals. We map out the scheme, identify the real pain points (where assessors diverge, where renewal deadlines slip, where the market fails to consult the register) and define the scope in an initial screen flow.
We translate the scheme into a formal data model: requirements, evidence, rubric, scoring, validity, renewal, revocation. At the same time, we establish the privacy and security design: data classification, GDPR lawful bases for each data flow, and a DPIA where justified. For accreditation-compliant schemes, we test against ISO/IEC 17024 or 17065.
Application and issuance flow first, then scheme management, then the multi-reviewer review flow, then the public register and API, then eIDAS QES and the complaints and revocation flow, then integrations with payments, accounting and external registers. You test alongside us, as do scheme managers and, where possible, real applicants and assessors.
Any existing certificates and historical audit reports held in your current system, Excel lists or Access environment are migrated in phases: new applications go into the new portal first, followed by historical certificates with integrity hashing and linkage to the scheme version that applied at the time.
A pilot group of assessors and a test group of applicants work in parallel on the old and new systems, and any discrepancies are resolved. Training sessions for scheme managers and assessors, short videos for applicants, and a go-live with a clear fallback procedure.
After go-live, we monitor performance, security and usage. New scheme versions, additional integrations or a new scheme are handled in small development sprints, so your portal grows with new standards and accreditation requirements.
What sets a certification portal apart is that compliance is not a coat of paint but the blueprint itself. We build the rules in so they cannot be circumvented, even by accident, and so that an accreditation audit of the system brings no surprises.
GDPR and special category personal data. Application files contain personal data and, depending on the scheme, CV details, examination scores, possibly health data or criminal record information. For every processing activity we record the lawful basis, restrict access to what is strictly necessary, and maintain a record of processing activities that updates automatically. A Data Protection Officer can run a report without needing a developer.
eIDAS QES and AES. For certificates with formal legal status, we work with a Qualified Trust Service Provider that signs with a QES, which is legally equivalent to a handwritten signature. For standard certificates, an AES is sufficient. The signature certificate and timestamp are recorded in the audit trail, so a client can later verify that the document was issued by your organisation at a specific moment.
Publication requirement and right to erasure. Alongside the confidentiality of the file sits the requirement to publish on the register. We build the register so that only data that may be public is published (name, scheme, validity, scope), and personal data and file contents remain strictly separated. The GDPR right to erasure runs through a separate workflow that respects your retention obligations.
NEN 7510 and ISO 27001 where applicable. For certifications with a healthcare link, we align with NEN 7510. For the portal itself, we build to ISO 27001 requirements so that your organisation can include the system in its own management system certification.
Our stack is deliberately conservative: certificates with validity periods of several years and renewal cycles that can run for decades call for a foundation that does not need to be rebuilt over and over.
Backend in Postgres with RBAC. Row-level security for multi-schema separation. The role-permission model lives in the database, so that even an ad hoc query passes through the same access control. For the public register, a separate read replica ensures that a surge in public traffic does not affect the assessors' work.
Frontend in Astro or Next.js. For your visibility, the public register is a marketing tool; we build it so that search engines index each certificate as its own page. For the assessors' workspace, React with TanStack Table for the more demanding data table screens.
Document store on S3-compatible storage with KMS. Object storage (AWS S3, GCS, Azure Blob or an EU-hosted variant), encryption at rest with KMS keys that you manage; for on-premises, MinIO. Versions are stored immutably with object lock where the retention obligation requires it; each upload receives an integrity hash in the audit trail.
Authentication via SSO, iDIN, eHerkenning and magic links. For staff, SSO on your existing identity provider with MFA. For applicants, iDIN, eHerkenning or magic link. For external clients, API keys with scope and rate limiting to the register.
Webhooks, retries and API versioning. Retry policy with exponential back-off, a dead-letter queue for failed events, signed payloads, and clear versioning so that an integration does not break when you add a schema field.
The questions we almost always receive in a first conversation.
A no-obligation introductory conversation of half an hour. We listen to your scheme, ask questions about your issuance volumes, assessment process and publication requirements, and give direction that is useful to you, even if the outcome is that an existing package suits you better than custom development. You can find more about our approach on the web development overview page.
Appfront uses cookies and similar technologies to keep the website working properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
