Verify the supplier before the purchase order
Onboarding, periodic re-evaluation and risk analysis query the same registries: the commercial registry, the sanctions lists, the contracts with the State and the rules that govern the category. Croma delivers them as one API so every supplier has a file with a source.
Free, no signup. The same query the API returns.
RUES lookup by NIT
Open the full toolA supplier has a public file in four different registries
When onboarding a supplier you have to confirm that it exists and who represents it: RUES by NIT in Colombia, the 11-digit RUC record at SUNAT with status (activo, baja) and condition (habido, no habido) in Peru, SIEM in Mexico, Sunbiz or Delaware in the United States. Then, whether it carries a disqualification: the Procuraduría's SIRI, the Contraloría's Boletín de Responsables Fiscales, the Boletín de Deudores Morosos del Estado, the sanctions recorded in SECOP, and in Brazil the CGU sanctions, the MTE's lista suja do trabalho escravo and the IBAMA embargoes. After that, how much it depends on the State: its contracts in SECOP II, entity by entity. And every quarter, what changed in the rules for what you buy from it.
Croma answers each question with the identifier the supplier already gave you (NIT, RUC, CNPJ, document number or file number) and with the same structure in the five countries. Onboarding becomes a sequence of calls; re-evaluation, the same sequence scheduled at the frequency your policy sets. Every answer names the source and the date, so the supplier file is built from records, not declarations.
What this team queries, and in what order
- 01
Supplier onboarding
RUES and Supersociedades by NIT; SUNAT by RUC; SIEM by name; Sunbiz and Delaware by registration number; PGFN, TST and Caixa by CNPJ. Existence, status, representative and tax and labor certificates.
See the solution - 02
Disqualifications and lists
Procuraduría, Contraloría, Contaduría and SECOP sanctions in Colombia; Tribunal del Servicio Civil in Peru; CGU, MTE and IBAMA in Brazil; OFAC for any counterparty, with the list updated daily.
See the solution - 03
What it has contracted with the State
SECOP II by supplier: which entities it contracted with, for how much and what status each contract is in, plus the sanctions and fines imposed on it. In Peru, the OECE's processes by OCID.
See the solution - 04
The rules that govern the category
Superfinanciera, DIAN, Función Pública and Imprenta Nacional in Colombia; DOF, Cámara de Diputados, Banxico, CNBV and CNSF in Mexico; Planalto in Brazil. What was published and what changed, with date.
See the solution
What changes with the official record in the flow
Onboarding with the record, not the declaration
The NIT, the RUC or the CNPJ bring the legal name, the status and the representative from the source. The supplier attaches fewer documents and the analyst stops transcribing forms.
Disqualifications before the purchase order
An entry in SIRI, a final fiscal liability ruling, a sanction as a contractor or an OFAC designation show up before signing, each with the entity that imposed it and the date.
Re-evaluation without starting over
The same sequence of lookups runs by API every month, every quarter or when the contract changes. Whatever has no record answers found: false and also goes in the file.
What the compliance team is going to ask about the file
A supplier's file mixes data about a company with data about its representatives, and the latter is personal data under Ley 1581 de 2012 in Colombia, the LFPDPPP in Mexico, Ley 29733 in Peru and the LGPD in Brazil. Croma delivers the public record exactly as the official source publishes it at the time of the query, with its provenance and its date; what you keep in the file, for how long and for what purpose is defined by your supplier policy, not the API. So that policy can be audited, every request to the API is logged, access is controlled by key and traffic is encrypted in transit. Fields are documented in the OpenAPI and any change is announced with 90 days of deprecation.
Official sources only
Every answer names the official registry that produced it. Nothing comes from purchased databases or third-party summaries.
Results that are never indexed
In the free tools the query and the result live in your browser, never in a URL. In the API: encryption in transit, access control and audit logging.
Personal data, with rules
Lookups on individuals require a legitimate purpose under each country's law: Ley 1581 in Colombia, LFPDPPP in Mexico, Ley 29733 in Peru, LGPD in Brazil. Croma delivers the record; the purpose and the legal basis are yours.
A stable contract
Every field is documented in the OpenAPI, with a 90-day deprecation policy and Deprecation and Sunset headers before anything is retired.
Frequently asked questions
Other industries
Banks and fintech
Onboarding, origination, court monitoring and collections on official records.
Insurers
Underwriting and claims by plate, broker verification, screening and litigation against the insurer.
Law firms
Batch radicados, case law, regulatory change, state contracting and counterparties, by API or MCP.
Collections and debt recovery
Daily court monitoring of the portfolio, insolvency, vehicle collateral and the court for each radicado.
Public sector and state contractors
Entities and contractors in SECOP, verified bidders, ANCP-CCE opinions, oversight and regulations.
Build the supplier file from official records
One key covers the commercial registry, the lists, the contracts with the State and the applicable rules in five countries. Try the lookup by NIT or RUC for free or book a demo with your vendor master.