Keystone
by CloudVoro
SALSA · Small producers

Traceability software for SALSA-audited producers.
The proportionate scheme deserves proportionate software.

SALSA (Safe and Local Supplier Approval) is the UK's certification scheme for small and micro food producers supplying local and regional buyers, a proportionate alternative to BRCGS. Proportionate doesn't mean soft: SALSA audits test traceability with the same core question, can you connect what came in to what went out, quickly, with records? Keystone answers that question in 30 seconds, at a price and implementation size built for small producers.

  • Lot-level records both directions, the core SALSA traceability ask
  • Timed traceability exercise: run it in minutes, document it properly
  • Batch-coded dispatch notes and labels without re-keying
  • €790/month flat, live in 30 days, sized for small producers, not enterprises
What SALSA audits test

The traceability section, in practice.

A SALSA audit walks your food safety system at a scale appropriate to a small producer, HACCP-based procedures, supplier control, labelling, and traceability. On traceability, expect the live exercise: the auditor picks a product or an ingredient and asks you to connect it through your records, supplier and lot inwards, batch in the middle, customers outwards, with quantities that add up. Producers pass this on paper systems every week; what fails is slow, person-dependent, or gap-ridden records. The preparation that matters is running the exercise on yourself, timed, before the auditor does.

Where Keystone fits

Small-producer software, not a cut-down enterprise suite.

Cheap capture, instant evidence
Goods-in, batches and dispatches take seconds to record; the trace chain and quantity reconciliation build themselves from those records.
The self-audit, built in
Run the timed traceability exercise any week: pick a lot, both directions, quantities included, signed PDF out, your audit-day rehearsal becomes routine.
Labelling support
Batch codes and dates flow to labels and dispatch notes, supporting lot-marking and allergen-emphasis diligence.
Room to grow
When a multiple comes calling and BRCGS enters the conversation, the same records serve the bigger audit, no system change at the worst possible moment.
SALSA or BRCGS?

Pick the badge your buyers actually require.

SALSA suits small and micro producers supplying independents, farm shops, delis, foodservice and regional retail. BRCGS is the multiples' default for own-label supply and the passport for larger contracts. Many producers hold SALSA first and step up to BRCGS when a retailer contract demands it, and the traceability discipline transfers completely if your records are lot-level from the start. If you're weighing the two, our guide to BRCGS's traceability requirements shows the top of the mountain; SALSA's ask is the same climb at a kinder gradient.

FAQ

Questions buyers actually ask.

Is Keystone SALSA-approved software?
No scheme approves software, SALSA audits producers. Keystone produces the traceability evidence the audit tests: lot-level records both directions, timed exercises, quantity reconciliation, and a signed audit trail.
Is software required to pass SALSA?
No, paper and spreadsheet systems pass SALSA audits regularly. Software earns its keep when records are slow, one person holds the system, or you're preparing to step up to retailer own-label supply.
Is Keystone affordable for a micro producer?
€790/month flat with all modules and a 30-day pilot at €2,500 (50% refundable). For very small producers still on efficient paper systems, we'll honestly say so on a discovery call.
What's the difference between SALSA and BRCGS?
Scale and audience. SALSA is proportionate certification for small/local suppliers; BRCGS is the GFSI-benchmarked standard the national multiples expect for own-label. The traceability fundamentals, lot records, both directions, timed evidence, are the same shape in both.
Can we move from SALSA to BRCGS on the same system?
Yes, that's the point of lot-level records from day one. The step up adds depth (mass balance tolerances, 4-hour timing evidence, vertical audits), not a different kind of record.

Ready to see if Keystone fits your floor?

20-minute discovery call. No sales pitch. Written scope within 48 hours if we fit, referral to someone better if we don't.

Talk to us
Compliance & trust

How we keep your
data and your audits safe.

Enterprise-grade controls as standard, encryption, MFA for every user, tenant isolation and immutable audit trails, on EU cloud or your own servers. Privacy queries go to privacy@cloudvoro.com. Sub-processor list at /legal/sub-processors. Full security posture at /site/security.

Live
Hosted in EU / Ireland, or on-premise
Customer data resides on AWS Ireland (eu-west-1) and never leaves the EU. Local on-premise deployment available where policy requires it.
Live
GDPR · Privacy Contact named
Internal Data Protection Lead handles subject access requests. Owner is ADPO Ireland member.
Live
MFA for every user
TOTP multi-factor authentication across all roles, with rate limiting, brute-force lockout and reCAPTCHA bot protection on public forms.
Live
ISO 27001 · aligned controls
Security controls mapped to the ISO/IEC 27001:2022 Annex A framework, access management, encryption, logging, incident response.
Live
NIS2 · supporting evidence
Tenant isolation, MFA and immutable audit trails give customers in NIS2 scope direct supporting evidence for their obligations.
Live
Encryption · at rest & in transit
TLS 1.3 in transit, industry-standard symmetric ciphers at rest, KMS-managed keys.