Subcontractor Vigilance

Stop chasing the certificates of your subcontractors

French law asks you to check, every 6 months, that each supplier you buy at least €5,000 excl. tax from is up to date with its social obligations (French Labour Code, articles L8222-1 and D8222-5). Without these checks, you can be held liable for the unpaid contributions and penalties of the supplier in case of undeclared work.

Subcontractor Vigilance organises this follow-up inside Dolibarr, where you buy.

Features

• One file per supplier: a “Vigilance” tab on the third party card with the profile (established in France, micro-entrepreneur, abroad, construction), the required documents, the status of each one and the history.
• Purchase threshold: validated supplier orders and invoices are added up over 12 months, the calendar year or per document. The threshold can be changed (€5,000 excl. tax by default) and a file can open automatically when it is reached.
• Existing suppliers: an assistant lists the suppliers already over the threshold, opens their files and sends the first request in one go.
• Document checks: validation with the issue date, refusal with a reason, authenticity check with the security code of the URSSAF certificate. The expiry date is computed for each type of document, and files switch to “To renew” then “Non compliant” by themselves.
• Automatic reminders: e-mails 30 and 7 days before the expiry, at the expiry, then every week. Editable templates, sent to the “Vigilance” contact of the supplier.
• Supplier portal: the supplier uploads documents from a personal link received by e-mail, with a login code. No Dolibarr account to create.
• Warnings, never blocking: banner on supplier orders and invoices, warning in the validation dialog and on payments. Purchases are never blocked; a purchase confirmed despite a warning is logged and shown on the dashboard.
• Sirene registry (optional): a scheduled job checks with INSEE that your suppliers are still active. Free key from the INSEE API portal.
• Dashboard and lists: compliance rate, documents to check, expiries within 30 days, amounts committed on incomplete files, filtered lists, choice of columns and export.

Automatic document analysis (optional)

• Each uploaded document can be read by Mistral AI: type, company, SIREN, dates, mandatory statements.
• The module compares what was read with the supplier and runs its own checks: SIREN, company name, dates, PDF modified after its creation, same file already sent for another supplier, company closed in Sirene.
• The reviewer sees the document next to the findings and a confidence level, then decides. The analysis never validates anything by itself.
• You use your own Mistral AI key, stored encrypted, with a monthly cap. You can choose processing in the European Union. Analysis costs are billed by Mistral AI and are not included in the module price.
• Without a key, the module works fully: manual checks, reminders, portal and warnings.

Proof for an inspection

• Chained audit log: every action (upload, validation, refusal, reminder, purchase confirmed despite a warning) is written in a log whose rows are chained by hash. A change shows up at verification.
• Proof file: export of one supplier as a ZIP for the period you choose: documents, PDF summary and audit log, ready to hand to URSSAF or to a client.
• Permissions: separate permissions to read, edit, validate, delete and export. Sensitive actions ask for a confirmation.
• Retention: configurable retention period and controlled purge of old documents, with the password asked before deletion.

Your data

• Documents stay in your Dolibarr, in the documents directory, outside the web root.
• Disabling the module deletes no data.

What the module does not do

The module helps you meet the vigilance duty; it does not meet it for you, and it is not legal advice. Required documents and delays can be set to match your situation. The authenticity of a certificate is checked by you on the website of the issuer; the module records the result. The automatic analysis gives an opinion, not a validation. The publisher is not affiliated with URSSAF, INSEE or Mistral AI.

Requirements

• Dolibarr 16.0 or later (tested on 16.0.5, 20.0.4 and 24.0.1, MariaDB/MySQL and PostgreSQL). PHP 7.4 or later with cURL.
• Modules “Third parties” and “Suppliers” enabled.
• E-mail sending set up in Dolibarr, for reminders and the portal.
• For the supplier portal: Dolibarr reachable from the Internet over https.
• Optional: a Mistral AI account (a paid plan is recommended) and a free key for the INSEE Sirene API.

Installation

1. Home › Setup › Modules › Deploy/install external app/module: upload module_vigilance-1.0.0.zip.
2. Enable the module “Subcontractor Vigilance” (family “Vendor Relationship Management (VRM)”).
3. In the module setup, check the threshold and the warnings, then the tabs “Reminders”, “E-mail templates” and “Supplier portal”. The tabs “Automatic analysis” and “Sirene register” are optional.
4. Grant the permissions to the users who need them: “Read vigilance files of subcontractors”, “Create and update vigilance files, upload documents, invite suppliers”, “Validate or refuse documents, record authenticity checks”, “Delete documents”, “Export proof files and vigilance data”, “View the usage and cost of the automatic analysis (AI)”.
5. Open Vigilance › Existing suppliers to start with the suppliers already over the threshold.

Good to know

A user guide in French is included and shown inside Dolibarr (Vigilance › User guide). The interface is translated into French and English.

Support by e-mail: support@news-cap.com (installation and bugs).